{"id":"CVE-2026-82014","aliases":["EUVD-2026-123538","GHSA-68ff-q76g-g93f"],"status":"published","title":"Team preferences RBAC bypass through the set-home-dash endpoint","description":"Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice (missing authorization).","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-14","score":0.00269,"percentile":0.19238,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-915"],"published":"2026-11-11T15:01:26Z","modified":"2026-11-11T15:31:13Z","products":[{"vendor":"grafana","product":"grafana enterprise"},{"vendor":"grafana","product":"grafana oss"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-82014","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82014"},{"url":"https://github.com/advisories/GHSA-68ff-q76g-g93f"}],"sources":{"cve":[{"id":"CVE-2026-82014","title":"Team preferences RBAC bypass through the set-home-dash endpoint","description":"Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice (missing authorization).","status":"published","published":"2026-11-11T15:01:26.306Z","modified":"2026-11-11T15:01:26.306Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-915"],"updated_at":"2026-11-11T15:29:21.468658Z"}],"euvd":[{"id":"EUVD-2026-123538","description":"Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice (missing authorization).","status":"published","published":"2026-11-11T15:01:26Z","modified":"2026-11-11T15:01:26Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-11T17:29:39.353655Z"}],"ghsa":[{"id":"GHSA-68ff-q76g-g93f","title":"Any authenticated user, including a Viewer, could change the preferences of any team, such as its...","description":"Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice (missing authorization).","status":"published","published":"2026-11-11T15:31:06Z","modified":"2026-11-11T15:31:13Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-915"],"updated_at":"2026-11-11T15:34:48.112751Z"}],"nvd":[{"id":"CVE-2026-82014","description":"Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice (missing authorization).","status":"published","published":"2026-11-11T15:17:25.02Z","modified":"2026-11-12T19:09:06.967Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-915"],"updated_at":"2026-11-11T17:25:38.53844Z"}]}}