CVE-2026-13719— Alert rules in restricted folders disclosed via the alert rules list API
Quick assessment
Affected
Grafana Grafana Enterprise
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
经过身份验证的用户可以通过告警规则 API 的列表端点，列出其无权读取的文件夹中存储的告警规则。当用户可读取的文件夹集合为空时，文件夹访问限制会被忽略，导致返回该组织内的所有告警规则。从 Grafana 13.1.0 版本开始，任何用户都可以通过指定文件夹过滤器来触发此问题。所暴露的数据为规则配置信息；数据源凭据不会被泄露。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-13719
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Alert rules in restricted folders disclosed via the alert rules list API
Source: CVE Program / CVE List V5
Vulnerability Description
An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Grafana | Grafana Enterprise | 12.3.0 ~ 12.3.11 | - |
|
| Grafana | Grafana OSS | 12.3.0 ~ 12.3.11 | - |
|
II. Public POCs for CVE-2026-13719
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-13719
请登录查看更多情报信息。
Other References for CVE-2026-13719 (1)
-
https://grafana.com/security/security-advisories/cve-2026-13719 vendor-advisory
IV. Related Vulnerabilities
Same product: Grafana Enterprise
-
CVE-2026-81842
Library panel can be moved into a folder without library pan -
CVE-2026-81841
Paused shared dashboard access tokens still expose data sour -
CVE-2026-14199
Session takeover via Auth Proxy cache key collision -
CVE-2026-12704
SAML assertion replay via skipped InResponseTo validation -
CVE-2026-28378
Cross-Organization Public Dashboard Deletion via Missing Org
Same vendor: Grafana
-
CVE-2026-13720
Editor can forge file-provisioning provenance on dashboards -
CVE-2026-81842
Library panel can be moved into a folder without library pan -
CVE-2026-81841
Paused shared dashboard access tokens still expose data sour -
CVE-2026-15815
CVE-2026-15815 CVE Record -
CVE-2026-76154
CVE-2026-76154 CVE Record
Same weakness: CWE-863
-
CVE-2026-103105
Pexip Infinity 40.0前版本本地API访问控制不当 -
CVE-2026-81842
Library panel can be moved into a folder without library pan -
CVE-2026-102330
Chrome 154.0.8037.92前SiteIsolation授权错误 -
CVE-2026-102327
Chrome Android 154.0.8037.92前WebView授权不当漏洞 -
CVE-2026-61519
Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPoli
V. Comments for CVE-2026-13719
No comments yet