CVE-2026-33379

HIGH8.5

Published 2026-11-06 · Source security@grafana.com

Description

A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

CWE-862

References

https://grafana.com/security/security-advisories/cve-2026-33379

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-123327
In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions
2026-11-06 · score 7.5
CVE-2026-123326
In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension
2026-11-06 · score 7.1
CVE-2026-123325
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page
2026-11-06 · score 7.1
CVE-2026-123324
In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible
2026-11-06 · score 7.7
CVE-2026-123323
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation
2026-11-06 · score 8.4