CVE-2026-81842 Library panel can be moved into a folder without library panel create permission
Authenticated users can move library panels to folders where they lack create permissions, bypassing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-81842?
CVE-2026-81842 is a medium-severity missing authorization vulnerability in Grafana Enterprise, published on 29 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authorization). No data from the destination folder is disclosed, and existing content there cannot be changed.
Weakness: CWE-863
Which versions are affected by CVE-2026-81842?
1 open source package ship an affected version, including grafana.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | From 12.1.0 | 12.4.12, 13.0.10 |
How do I fix CVE-2026-81842?
Upgrade grafana to a fixed version for your release line: 12.4.12 or 13.0.10.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-81842 being exploited?
There is no known exploitation of CVE-2026-81842 in the wild and no public exploit code.
Sources
Also known as BIT-grafana-2026-81842, GHSA-37j9-5rxj-3hwp, MINI-4jp3-3996-9xmv, MINI-5335-f8xw-57v5, MINI-5m8r-m45f-gpcp, MINI-7f3p-f5x4-g9j5 and 6 more.