CVE-2026-21721 Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation
Attackers with dashboard management rights can bypass scope checks to modify permissions on other dashboards, leading to internal privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-21721?
CVE-2026-21721 is a high-severity missing authorization vulnerability in Grafana Grafana, published on 27 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
Which versions are affected by CVE-2026-21721?
1 open source package ship an affected version, including grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | From 10.2.0 | 11.6.9, 12.0.8, 12.1.5, 12.2.3, 12.3.1 |
Linux distribution packages (8)
grafana Red Hat:enterprise_linux_eus:10.0 | All versions | 0:10.2.6-20.el10_0 |
grafana-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:10.2.6-20.el10_0 |
grafana-debugsource Red Hat:enterprise_linux_eus:10.0 | All versions | 0:10.2.6-20.el10_0 |
grafana-selinux Red Hat:enterprise_linux_eus:10.0 | All versions | 0:10.2.6-20.el10_0 |
grafana Red Hat:rhel_eus:9.6::appstream | All versions | 0:10.2.6-17.el9_6 |
grafana-debuginfo Red Hat:rhel_eus:9.6::appstream | All versions | 0:10.2.6-17.el9_6 |
grafana-debugsource Red Hat:rhel_eus:9.6::appstream | All versions | 0:10.2.6-17.el9_6 |
grafana-selinux Red Hat:rhel_eus:9.6::appstream | All versions | 0:10.2.6-17.el9_6 |
Products include Grafana Grafana.
How do I fix CVE-2026-21721?
Upgrade grafana to a fixed version for your release line: 11.6.9, 12.0.8, 12.1.5 or 12.2.3.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-21721 being exploited?
There is no known exploitation of CVE-2026-21721 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Grafana Grafana
Sources
Also known as BIT-grafana-2026-21721, CLSA-2026-1772812307, GHSA-jgfq-mgxg-4qwm, MINI-294m-235h-5gcf, MINI-62w5-jxp3-7gh2, MINI-6r7p-5x33-6fx3 and 14 more.