CVE-2026-33379: Dashboard snapshot permission bypass

Published Nov 6, 2026

Updated

A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Grafana to a version that resolves this vulnerability.
Fixed in 13

Event History

Nov 6, 2026

CVE Published

via MITRE·10:05 AM

Data Sourced

via MITRE·10:05 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Grafana deployments are affected?

Only Grafana OSS and Grafana Enterprise 12.4 are affected. Earlier versions and Grafana 13 are not affected.

Does exploitation require a privileged Grafana account?

No. An authenticated user with any role can exploit the issue, including a Viewer or a service account with no permissions.

What can an affected low-privilege account do?

It can create, externally publish, and delete dashboard snapshots without the required authorization.

CVE-2026-33379: Dashboard snapshot permission bypass

Remediation

Event History

Frequently Asked Questions

Which Grafana deployments are affected?

Does exploitation require a privileged Grafana account?

What can an affected low-privilege account do?

Company

Resources

Contact

Frequently Asked Questions

Which Grafana deployments are affected?

Does exploitation require a privileged Grafana account?

What can an affected low-privilege account do?