CVE-2026-21721

Katalog CVE

CVSS 8.1 · High EPSS 0,74%

Kerentanan Incorrect Authorization pada grafana. Skor CVSS 3.1 8.1 (High) menurut grafana.com.

Deskripsi (NVD)

The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.

Rincian

Terbit di NVD

27 Januari 2026

Terakhir diubah

20 Juli 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber grafana.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://grafana.com/security/security-advisories/cve-2026-21721 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:2914
• https://access.redhat.com/errata/RHSA-2026:2920
• https://access.redhat.com/errata/RHSA-2026:3078
• https://access.redhat.com/errata/RHSA-2026:3529
• https://access.redhat.com/errata/RHSA-2026:41064
• https://access.redhat.com/errata/RHSA-2026:5633
• https://access.redhat.com/errata/RHSA-2026:8229
• https://access.redhat.com/security/cve/CVE-2026-21721
• https://bugzilla.redhat.com/show_bug.cgi?id=2433242
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21721.json