Vulnerability Description
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana | >= 10.2.0, < 11.6.9 |
Related Weaknesses (CWE)
References
- https://grafana.com/security/security-advisories/cve-2026-21721Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:2914
- https://access.redhat.com/errata/RHSA-2026:2920
- https://access.redhat.com/errata/RHSA-2026:3078
- https://access.redhat.com/errata/RHSA-2026:3529
- https://access.redhat.com/errata/RHSA-2026:41064
- https://access.redhat.com/errata/RHSA-2026:5633
- https://access.redhat.com/errata/RHSA-2026:8229
- https://access.redhat.com/security/cve/CVE-2026-21721
- https://bugzilla.redhat.com/show_bug.cgi?id=2433242
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21721.json
FAQ
What is CVE-2026-21721?
CVE-2026-21721 is a vulnerability with a CVSS score of 8.1 (HIGH). The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard ...
How severe is CVE-2026-21721?
CVE-2026-21721 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-21721?
Check the references section above for vendor advisories and patch information. Affected products include: Grafana Grafana.