High severity8.5NVD Advisory· Published Nov 6, 2026

CVE-2026-33379

Description

A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.

Affected products

Grafana/Grafanallm-fuzzy
Range: <12.4
Grafana/Grafana Enterprisellm-fuzzy
Range: <12.4

Patches

Vulnerability mechanics

References

grafana.com/security/security-advisories/cve-2026-33379nvd

News mentions

No linked articles in our index yet.

cvss	0.552
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000