CVE-2026-19197
Received Received - Intake

Grafana Dashboard Snapshot Access Control Flaw

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: Grafana Labs

Description
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-19197
EUVD
EUVD-2026-66377

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
grafana grafana *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an organization administrator in Grafana to delete dashboard snapshots owned by other organizations on the same instance. Additionally, they can recover a snapshot's secret delete key using only its public share key due to broken access control.

Impact Analysis

If you are a Grafana user, an attacker with organization admin privileges could delete your dashboard snapshots or gain unauthorized access to them. This could lead to loss of critical data or exposure of sensitive information.

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by enabling unauthorized access or deletion of sensitive data. Organizations using Grafana may face compliance risks if snapshots contain regulated information.

Mitigation Strategies

Restrict organization administrator permissions to only trusted users. Review and update Grafana instance access controls to prevent unauthorized snapshot deletions and secret key recovery.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19197. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart