CVE-2026-82014
Received
Received - Intake
Authenticated User Preference Modification in Grafana
Vulnerability report for CVE-2026-82014, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-11
Last updated on: 2026-11-11
Assigner: Grafana Labs
Description
Description
Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice (missing authorization).
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Grafana | Grafana Enterprise | From 5.4.0 (inc) to 11.5.10 (inc) |
| Grafana | Grafana Enterprise | From 11.6.0 (inc) to 11.6.16 (inc) |
| Grafana | Grafana Enterprise | From 12.0.0 (inc) to 12.0.10 (inc) |
| Grafana | Grafana Enterprise | From 12.1.0 (inc) to 12.1.10 (inc) |
| Grafana | Grafana Enterprise | From 12.2.0 (inc) to 12.2.11 (inc) |
| Grafana | Grafana Enterprise | From 12.3.0 (inc) to 12.3.11 (inc) |
| Grafana | Grafana Enterprise | From 12.4.0 (inc) to 12.4.14 (inc) |
| Grafana | Grafana Enterprise | From 13.0.0 (inc) to 13.0.12 (inc) |
| Grafana | Grafana OSS | From 5.4.0 (inc) to 11.5.10 (inc) |
| Grafana | Grafana OSS | From 11.6.0 (inc) to 11.6.16 (inc) |
| Grafana | Grafana OSS | From 12.0.0 (inc) to 12.0.10 (inc) |
| Grafana | Grafana OSS | From 12.1.0 (inc) to 12.1.10 (inc) |
| Grafana | Grafana OSS | From 12.2.0 (inc) to 12.2.11 (inc) |
| Grafana | Grafana OSS | From 12.3.0 (inc) to 12.3.11 (inc) |
| Grafana | Grafana OSS | From 12.4.0 (inc) to 12.4.14 (inc) |
| Grafana | Grafana OSS | From 13.0.0 (inc) to 13.0.12 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-915 | The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. |
