Grafana
CVE-2026-33379: A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authori
CVE-2026-33379 Nov 6, 2026 Source: Vendor
A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-33379
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
1 line
Showing 1–1 of 1
CVE-2026-33379
BR2026-0000-042910
unclaimed
Credited as arang