CVE-2026-16491— CVE-2026-16491 CVE Record
Quick assessment
Affected
Grafana Grafana Enterprise
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Grafana 的基于角色的访问控制（RBAC）服务在检查用户是否为已删除仪表板列表的文件夹管理员时，忽略了请求的文件夹。因此，任何拥有某个文件夹仪表板权限管理权的用户，都可能被错误地视为所有文件夹的管理员。 这可能导致用户能够访问其本无管理权限的文件夹中的已删除仪表板项。修复方案要求用户必须对指定文件夹、其上级文件夹，或通配符范围拥有相应权限。
Affected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Grafana | Grafana Enterprise | 13.0.0≤ 13.0.4 |
affected |
13.1.0≤ 13.1.1 |
affected | ||
13.0.0≤ 13.1.0 |
affected | ||
| Grafana | Grafana OSS | 13.0.0≤ 13.1.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16491
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CVE-2026-16491 CVE Record
Source: CVE Program / CVE List V5
Vulnerability Description
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.
This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Grafana | Grafana Enterprise | 13.0.0 ~ 13.0.4 | - |
|
| Grafana | Grafana Enterprise | 13.0.0 ~ 13.1.0 | - |
|
| Grafana | Grafana OSS | 13.0.0 ~ 13.1.1 | - |
|
II. Public POCs for CVE-2026-16491
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16491
请登录查看更多情报信息。
Other References for CVE-2026-16491 (1)
-
https://grafana.com/security/security-advisories/cve-2026-16491 vendor-advisory
IV. Related Vulnerabilities
Same product: Grafana Enterprise
-
CVE-2026-92539
Cross-organization user modification and deletion via the SC -
CVE-2026-9703
Viewer role can create, modify and delete Loki alerting rule -
CVE-2026-93294
Azure Monitor data source resource proxy allows calls to arb -
CVE-2026-33374
Unbounded memory allocation in the Prometheus rule conversio -
CVE-2026-15577
Git Sync connection configuration can be modified with read-
Same vendor: Grafana
-
CVE-2026-92539
Cross-organization user modification and deletion via the SC -
CVE-2026-9703
Viewer role can create, modify and delete Loki alerting rule -
CVE-2026-33374
Unbounded memory allocation in the Prometheus rule conversio -
CVE-2026-95502
Git Sync memory exhaustion via a malicious Git server -
CVE-2026-15577
Git Sync connection configuration can be modified with read-
Same weakness: CWE-862
-
CVE-2026-112355
MembershipWorks WordPress Plugin < 6.17 Information Disclosu -
CVE-2026-108301
Tanium addressed an improper access controls vulnerability i -
CVE-2026-116660
Tanium addressed an improper access controls vulnerability i -
CVE-2026-116677
OpenWISP Controller CA CRL REST API does not scope requests -
CVE-2026-10752
Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Author