CVE-2026-33377
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard.
Published May 13, 2026 · updated Jun 17, 2026 · grafana grafana
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 13, 2026 · NIST NVD
Detected
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
Jun 17, 2026 · NIST NVD
Updated
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
Affected
- cpe grafana/grafanaversion unspecified
- cpe grafana/grafana11.6.14
- cpe grafana/grafana12.2.8
Sources
- CVE.orgVulnerability recordCVE-2026-33377
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33377
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
nvd.nist.gov