CVE-2026-11817

Received Received - Intake

Information Disclosure in Grafana Multi-Organization Stacks

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: Grafana Labs

Description

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-11817

EUVD

EUVD-2026-60478

Affected Vendors & Products

Vendor	Product	Version / Range
grafana	grafana	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects Grafana stacks with multiple organizations. An Org Admin in one organization can access permission data (dashboard/folder UIDs and user permissions) of other organizations via a specific API call. Single-organization deployments are not impacted.

Detection Guidance

To detect this vulnerability, check if your Grafana stack is configured with multiple organizations. Verify if Org Admins can access dashboard and folder UIDs across organizations via the affected API endpoint.

Impact Analysis

If you use a multi-organization Grafana stack, an attacker with Org Admin access could view limited metadata about dashboards and permissions across organizations. Dashboard contents, data, and secrets remain secure.

Compliance Impact

This vulnerability may pose compliance risks by exposing organizational structure and access patterns. However, since no sensitive data (like personal or health data) is disclosed, the impact on GDPR or HIPAA is likely minimal.

Mitigation Strategies

If using a multi-organization Grafana stack, restrict access to the GET /api/access-control/users/permissions/search endpoint. Limit Org Admin privileges to prevent cross-organization data exposure. Consider disabling multi-organization features if not required.

Hi! I’m here to help you understand CVE-2026-11817. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70