CVE-2026-21721: Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions: action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21721?
CVE-2026-21721 is considered a high severity vulnerability due to its potential to allow cross-dashboard privilege escalation.
How do I fix CVE-2026-21721?
To fix CVE-2026-21721, apply the latest security updates provided by your software vendor that address the dashboard permissions scope bypass.
What impact does CVE-2026-21721 have on users?
CVE-2026-21721 allows unauthorized users to read and modify dashboards, resulting in potential data exposure and unauthorized access.
Which versions are affected by CVE-2026-21721?
CVE-2026-21721 affects specific versions of the dashboard permissions API in the software where the vulnerability exists.
Is there a workaround for CVE-2026-21721?
As of now, the best approach to mitigate CVE-2026-21721 is to limit user permissions until a proper patch is applied.