High severity7.1NVD Advisory· Published May 13, 2026· Updated Jun 17, 2026
CVE-2026-33377
CVE-2026-33377
Description
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
18cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*+ 10 more
- cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*range: >=8.5.0,<11.6.14
- cpe:2.3:a:grafana:grafana:11.6.14:-:*:*:*:*:*:*
- cpe:2.3:a:grafana:grafana:11.6.14:security01:*:*:*:*:*:*
- cpe:2.3:a:grafana:grafana:12.2.8:-:*:*:*:*:*:*
- cpe:2.3:a:grafana:grafana:12.2.8:security01:*:*:*:*:*:*
- cpe:2.3:a:grafana:grafana:12.3.6:-:*:*:*:*:*:*
- cpe:2.3:a:grafana:grafana:12.3.6:security01:*:*:*:*:*:*
- cpe:2.3:a:grafana:grafana:12.4.3:-:*:*:*:*:*:*
- cpe:2.3:a:grafana:grafana:13.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:grafana:grafana:13.0.1:-:*:*:*:*:*:*
- (no CPE)
- osv-coords7 versionspkg:apk/chainguard/grafana-12.4pkg:apk/wolfi/grafana-12.4pkg:bitnami/grafanapkg:rpm/almalinux/grafanapkg:rpm/almalinux/grafana-selinuxpkg:rpm/opensuse/grafana&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/grafana&distro=openSUSE%20Tumbleweed
< 12.4.3.02-r0+ 6 more
- (no CPE)range: < 12.4.3.02-r0
- (no CPE)range: < 12.4.3.02-r0
- (no CPE)range: >= 8.5.0, < 11.6.14
- (no CPE)range: < 10.2.6-28.el10_2.4
- (no CPE)range: < 10.2.6-28.el10_2.4
- (no CPE)range: < 11.6.14+security04-bp160.1.1
- (no CPE)range: < 11.6.14+security04-1.1
Patches
Vulnerability mechanics
References
1- grafana.com/security/security-advisories/cve-2026-33377nvdVendor Advisory
News mentions
0No linked articles in our index yet.