A flaw was found in Grafana. The application fails to verify creation permissions on destination folders during panel update operations. An authenticated user with edit permissions in one folder can exploit this vulnerability through the library elements API to move a library panel into a folder where they only possess view permissions. This allows an unauthorized user to bypass access controls and place content into restricted folders.
Last checked: 2026-09-30 19:21 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-30 15:04 UTC)
Fix evidence last checked: 2026-10-01 11:04 UTC