CVE-2026-13720

Medium

Description

An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.

SeverityMedium

CVSS5.4

Exploit probability—

Product

Grafana OSS

PublishedSep 30, 2026

First seenSep 30, 2026

Weakness typeCWE-285CWE-285 CWE-915CWE-915 CWE-345CWE-345

How to fix

Update

Grafana Grafana OSS12.4.12, 13.0.10, 13.1.7, 13.2.3 or later
Grafana Grafana Enterprise12.4.12, 13.0.10, 13.1.7, 13.2.3 or later

Vendor advisories

grafana.com/security/security-advisories/cve-2026-13720

Affected products

Product	Affected versions	Fixed in
Grafana Grafana OSS	12.0.0 ≤ v ≤ 12.0.10, 12.1.0 ≤ v ≤ 12.1.10, 12.2.0 ≤ v ≤ 12.2.11, 12.3.0 ≤ v ≤ 12.3.11, 12.4.0 ≤ v < 12.4.12, 13.0.0 ≤ v < 13.0.10, 13.1.0 ≤ v < 13.1.7, 13.2.0 ≤ v < 13.2.3	12.4.12, 13.0.10, 13.1.7, 13.2.3
Grafana Grafana Enterprise	12.0.0 ≤ v ≤ 12.0.10, 12.1.0 ≤ v ≤ 12.1.10, 12.2.0 ≤ v ≤ 12.2.11, 12.3.0 ≤ v ≤ 12.3.11, 12.4.0 ≤ v < 12.4.12, 13.0.0 ≤ v < 13.0.10, 13.1.0 ≤ v < 13.1.7, 13.2.0 ≤ v < 13.2.3	12.4.12, 13.0.10, 13.1.7, 13.2.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.