CVE-2026-33377 Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin
An Editor can escalate privileges to Dashboard Admin by overwriting ACLs during dashboard import, requiring write access to the target dashboard.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33377?
CVE-2026-33377 is a high-severity vulnerability in Grafana Grafana, published on 13 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
Which versions are affected by CVE-2026-33377?
1 open source package ship an affected version, including grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | From 8.5.0 | 11.6.14, 12.2.8, 12.3.6, 12.4.3, 13.0.1 |
Products include Grafana Grafana.
How do I fix CVE-2026-33377?
Upgrade grafana to a fixed version for your release line: 11.6.14, 12.2.8, 12.3.6 or 12.4.3.
Is CVE-2026-33377 being exploited?
There is no known exploitation of CVE-2026-33377 in the wild and no public exploit code.
Other vulnerabilities in Grafana Grafana
Sources
Also known as BIT-grafana-2026-33377, GHSA-5cv7-h7gr-wjgh, MINI-273f-jrqp-8qpw, MINI-387f-c28h-qw3r, MINI-3pm8-746w-r4c9, MINI-3w4v-g5rf-cm7j and 13 more.