RHSA-2026:76448 | Vulnetix

RHSA-2026:76448 PUBLISHED CVSS 5.300000190734863 MEDIUM

A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing administrators from modifying or deleting it through the Grafana web interface. The impact is restricted to the editor's organization and does not expose sensitive data.

Risk Scores

CVSS 3.1

5.300000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Products

Vendor	Product	Versions
Red Hat	grafana13.1-0:13.1.7-0.1.hum1@aarch64 as a component of Red Hat Hardened Images	13.1-0:13.1.7-0.1.hum1
Red Hat	grafana13.1-0:13.1.7-0.1.hum1@x86_64 as a component of Red Hat Hardened Images	13.1-0:13.1.7-0.1.hum1
Red Hat	grafana13.1-0:13.1.7-0.1.hum1@src as a component of Red Hat Hardened Images	13.1-0:13.1.7-0.1.hum1

Timeline

Oct 5, 2026 CVE Published
Oct 13, 2026 CVE Updated
Oct 13, 2026 Distribution Patch
Oct 13, 2026 Distribution Patch
Oct 13, 2026 Security Advisory
Oct 13, 2026 Security Advisory
Oct 13, 2026 Security Advisory
Oct 13, 2026 Security Advisory
Oct 13, 2026 Security Advisory
Oct 13, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:76448 advisory
https://images.redhat.com/ advisory
https://access.redhat.com/security/cve/CVE-2026-13720 advisory
https://access.redhat.com/security/updates/classification/ advisory
https://access.redhat.com/security/cve/CVE-2026-13719 advisory
https://access.redhat.com/security/cve/CVE-2026-81841 advisory
https://access.redhat.com/security/cve/CVE-2026-56851 advisory
https://access.redhat.com/security/cve/CVE-2026-61801 advisory
https://access.redhat.com/security/cve/CVE-2024-24786 advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76448.json advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2268046 issue
https://www.cve.org/CVERecord?id=CVE-2024-24786 advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-24786 advisory
https://go.dev/cl/569356 advisory
https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/ advisory
https://pkg.go.dev/vuln/GO-2024-2611 advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2543885 issue
https://www.cve.org/CVERecord?id=CVE-2026-13719 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-13719 advisory
https://grafana.com/security/security-advisories/cve-2026-13719 advisory

…and 14 more

Open in Interactive Console →