CVE-2026-16491

Medium

Description

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.

SeverityMedium

CVSS6.5

Exploit probability—

Product

Grafana Enterprise

PublishedOct 27, 2026

First seenOct 27, 2026

Weakness typeCWE-862Missing authorization

How to fix

Vendor advisories

grafana.com/security/security-advisories/cve-2026-16491

Affected products

Product	Affected versions	Fixed in
Grafana Grafana Enterprise	13.0.0 ≤ v ≤ 13.0.4, 13.1.0 ≤ v ≤ 13.1.1, 13.0.0 ≤ v ≤ 13.1.0	—
Grafana Grafana OSS	13.0.0 ≤ v ≤ 13.1.1	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.