{"id":"CVE-2026-13720","aliases":["ALPINE-CVE-2026-13720","BIT-grafana-2026-13720","EUVD-2026-89775","GHSA-9q62-r26p-xcjv","RHSA-2026:74164","RHSA-2026:76430","RHSA-2026:76448"],"status":"published","title":"Editor can forge file-provisioning provenance on dashboards via the dashboard API","description":"An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00157,"percentile":0.04939,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285","CWE-345","CWE-915"],"published":"2026-09-30T11:06:38Z","modified":"2026-11-04T22:30:02Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"grafana","fixed_in":["12.4.14-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"grafana","fixed_in":["12.4.12","13.0.10","13.1.7","13.2.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.14-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0"},{"fixed":"12.4.12"},{"introduced":"13.0.0"},{"fixed":"13.0.10"},{"introduced":"13.1.0"},{"fixed":"13.1.7"},{"introduced":"13.2.0"},{"fixed":"13.2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.12-0.2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.3-0.1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.7-0.1.hum1"}]}],"bundled":8}],"products":[{"vendor":"grafana","product":"grafana enterprise"},{"vendor":"grafana","product":"grafana oss"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-13720","tags":["vendor-advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13720","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9q62-r26p-xcjv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-13720","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74164","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13720","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13719","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81841","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81842","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76154","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74164.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543885","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13719","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13719","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-13719","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543886","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13720","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528028","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76154","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543644","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81841","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81841","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-81841","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543653","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81842","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81842","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-81842","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76430","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56851","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-61801","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24786","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101899","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97394","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76430.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268046","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24786","tags":["advisory"]},{"url":"https://go.dev/cl/569356","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2611","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547607","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56851","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56851","tags":["advisory"]},{"url":"https://go.dev/cl/793360","tags":["article"]},{"url":"https://go.dev/issue/80112","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6629","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548048","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-61801","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61801","tags":["advisory"]},{"url":"https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe","tags":["article"]},{"url":"https://github.com/moby/sys/pull/221","tags":["article"]},{"url":"https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553575","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97394","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97394","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi/commit/30e292371a89ca6d1f91a9553e0aa518b49f838d","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/releases/tag/v0.143.0","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-p6wj-qrr4-pgh5","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550659","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101899","tags":["advisory"]},{"url":"https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","tags":["article"]},{"url":"https://github.com/axios/axios/pull/11141","tags":["article"]},{"url":"https://github.com/axios/axios/releases/tag/v1.20.0","tags":["article"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76448","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76448.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-13720","title":"Editor can forge file-provisioning provenance on dashboards via the dashboard API","description":"An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.","status":"published","published":"2026-09-30T11:06:38.177Z","modified":"2026-09-30T15:28:07.969Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-285","CWE-915","CWE-345"],"updated_at":"2026-11-02T14:19:50.24628Z"}],"euvd":[{"id":"EUVD-2026-89775","description":"An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.","status":"published","published":"2026-09-30T11:06:38Z","modified":"2026-09-30T15:28:07Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T17:27:49.016334Z"}],"ghsa":[{"id":"GHSA-9q62-r26p-xcjv","title":"An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId...","description":"An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.","status":"published","published":"2026-09-30T12:35:17Z","modified":"2026-09-30T12:35:21Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:12:35.884172Z"}],"nvd":[{"id":"CVE-2026-13720","description":"An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.","status":"published","published":"2026-09-30T11:16:43.893Z","modified":"2026-09-30T17:23:08.953Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-285","CWE-345","CWE-915"],"updated_at":"2026-11-02T14:12:52.759595Z"}],"osv":[{"id":"ALPINE-CVE-2026-13720","description":"An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.","status":"published","published":"2026-09-30T11:16:43.893Z","modified":"2026-11-04T22:30:02.827385486Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-04T22:39:43.298532Z"},{"id":"RHSA-2026:74164","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-02T10:25:46Z","modified":"2026-10-06T10:42:41.902275152Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:76430","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-06T10:19:13Z","modified":"2026-10-20T10:43:33.721268511Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:76448","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-06T10:19:14Z","modified":"2026-10-20T10:43:36.573107849Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"BIT-grafana-2026-13720","title":"Editor can forge file-provisioning provenance on dashboards via the dashboard API","description":"An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.","status":"published","published":"2026-10-09T10:46:27.565Z","modified":"2026-10-09T12:00:07.095946699Z","updated_at":"2026-11-02T15:28:31.02759Z"}]}}