Description
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.
Published: 2026-09-30
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authorization bypass
Action: Patch immediately
AI Analysis

Impact

An Editor can set file‑provisioning metadata—grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath—when creating a dashboard via the dashboard API because these fields were stored without an authorization check. The dashboard then appears file‑provisioned, and administrators are unable to update or delete it through Grafana. The vulnerability does not expose data, but it removes administrative control over the dashboard within the same organization.

Affected Systems

The affected products are Grafana Enterprise and Grafana OSS. Version details are not listed in the advisory and therefore are unknown.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting a limited exploitation window. The likely attack vector is the dashboard API used by users with the Editor role; it requires legitimate API access within the same organization. Because no data is exposed and the impact is confined to the ability of administrators to manage dashboards, the overall risk is moderate, but it can disrupt normal governance and maintenance processes.

Generated by OpenCVE AI on September 30, 2026 at 12:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official Grafana patch as described in the advisory
  • Re or restrict the ability of users with the Editor role to set file‑provisioning metadata via the API
  • Audit existing dashboards for the presence of file‑provisioning annotations and correct or remove them as needed
  • Implement monitoring of dashboard API calls for unexpected metadata changes

Generated by OpenCVE AI on September 30, 2026 at 12:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 30 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Grafana
Grafana grafana
Grafana grafana Enterprise
Vendors & Products Grafana
Grafana grafana
Grafana grafana Enterprise

Wed, 30 Sep 2026 11:15:00 +0000

Type Values Removed Values Added
Description An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.
Title Editor can forge file-provisioning provenance on dashboards via the dashboard API
Weaknesses CWE-285
CWE-345
CWE-915
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

Subscriptions

Grafana Grafana Grafana Enterprise
cve-icon MITRE

Status: PUBLISHED

Assigner: GRAFANA

Published:

Updated: 2026-09-30T15:28:07.969Z

Reserved: 2026-06-29T14:11:02.739Z

Link: CVE-2026-13720

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-30T11:16:43.893

Modified: 2026-09-30T17:23:08.953

Link: CVE-2026-13720

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-30T11:06:38Z

Links: CVE-2026-13720 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T20:15:05Z

Weaknesses
  • CWE-285

    Improper Authorization

  • CWE-345

    Insufficient Verification of Data Authenticity

  • CWE-915

    Improperly Controlled Modification of Dynamically-Determined Object Attributes