CVE-2026-81842

Awaiting Analysis Awaiting Analysis - Queue

Authenticated Library Panel Move in Grafana

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: Grafana Labs

Description

An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authorization). No data from the destination folder is disclosed, and existing content there cannot be changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-81842

Affected Vendors & Products

Vendor	Product	Version / Range
grafana	grafana	From 12.1.0 (inc)
grafana	grafana	From 12.4.12 (inc)
grafana	grafana	From 13.0.0 (inc)
grafana	grafana	From 13.0.10 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated user with edit rights in one folder to move a library panel into another folder where they only have view permission. The issue is that the system did not verify if the user had permission to create panels in the destination folder during the move operation.

Detection Guidance

This vulnerability requires authenticated access and involves moving library panels between folders with different permissions. Detection would involve checking API logs for unauthorized folder movements or library panel updates via the library elements API or App Platform resource.

Impact Analysis

The impact is limited. No data from the destination folder is exposed, and existing content cannot be altered. However, unauthorized movement of panels could disrupt organization or visibility of dashboard elements.

Compliance Impact

This vulnerability does not directly disclose or modify data, so it likely has minimal impact on GDPR or HIPAA compliance. However, unauthorized modification of UI elements could affect data presentation integrity, potentially violating record-keeping requirements under these regulations.

Mitigation Strategies

Update to the latest patched version of Grafana to address the authorization flaw in the library elements API. Ensure only authorized users have edit permissions on folders to prevent unauthorized panel movements.

Hi! I’m here to help you understand CVE-2026-81842. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70