Security Advisory

CVE-2026-21721

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-01-27 09:07:55

Last updated 2026-07-24 12:23:10

Assigner GRAFANA

CVSS score 8.1

State PUBLISHED

Description

The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.

← Browse all CVEs View on cve.org ↗