CVE-2026-21721

Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation

HIGH

8.1

CVSS Score

Published: January 27, 2026 at 09:07 AM UTC

Updated: July 20, 2026 at 05:48 PM UTC

3 products affected across 2 vendorsGrafanaCeph StorageMulticluster Global Hub

Using grafana/grafana by Grafana?

Get instant alerts when new vulnerabilities affect grafana/grafana - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.1

Exploit prediction

EPSS 0.7%

SSVC

No known exploit

Description

The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Grafana · Grafana

95%

10.2.0 ≤ v < 11.6.912.0.0 ≤ v < 12.0.812.1.0 ≤ v < 12.1.512.2.0 ≤ v < 12.2.312.3.0 ≤ v < 12.3.110.2.0 11.6.9 12.0.0 12.0.8 12.1.0 12.1.5 12.2.0 12.2.3 12.3.0 12.3.1

Affected range stops below 11.6.9, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.0.8, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.1.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.2.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.3.1, so it looks safe — our inference, not a vendor statement

Ceph Storage · Red Hatrpm

60%

Multicluster Global Hub · Red Hatcontainer

60%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://grafana.com/security/security-advisories/cve-2026-21721

References (13)

Source: cverecord

https://grafana.com/security/security-advisories/CVE-2026-21721

Vendor Advisory

Source: cverecord

https://grafana.com/security/security-advisories/cve-2026-21721