CVE-2026-11817— CVE-2026-11817 CVE Record
Possible ATT&CK Techniques 1AI
T1005 · Data from Local SystemGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-11817
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CVE-2026-11817 CVE Record
Source: CVE Program / CVE List V5
Vulnerability Description
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Grafana | Grafana OSS | 12.4.0 ~ 12.4.5 | - | |
| Grafana | Grafana Enterprise | 13.0.0 ~ 13.0.3 | - |
II. Public POCs for CVE-2026-11817
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-11817
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-11817 (1)
- 🔗 404 Page not found | Grafana Labsvendor-advisory
IV. Related Vulnerabilities
Same product: Grafana OSS
Same weakness: CWE-863
- CVE-2026-45122
MyBB: Insufficient permission check for calendar event move - CVE-2026-45121
MyBB: Insufficient permission check for calendar select - CVE-2026-70657
Copyparty: file/dirkey confusion - CVE-2026-74906
SiYuan before v3.7.4 Incorrect Authorization via Publish Acc - CVE-2026-9859
Mattermost Boards plugin didn’t enforce role-based authoriza
V. Comments for CVE-2026-11817
No comments yet