CVE-2026-16491: CVE Record
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.
This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user must already have dashboard permission-management rights on at least one folder. That user can be incorrectly treated as a folder administrator when viewing deleted dashboard listings for other folders.
What data may be exposed?
The issue can expose deleted dashboard items from folders for which the user does not have administrative access. The provided information does not indicate that active dashboards or other resource types are affected.
What access check should be enforced after remediation?
Authorization must be evaluated against the requested folder. Valid permission scope includes the specified folder, one of its ancestors, or a wildcard scope.