CVE-2026-11817: 
Grafana vulnerability analysis and mitigation

CVE-2026-11817 is a cross-organization information disclosure vulnerability in Grafana OSS and Grafana Enterprise affecting multi-organization deployments. An authenticated Org Admin of a single organization can query the GET /api/access-control/users/permissions/search?actionPrefix=dashboards: API endpoint and receive permission data belonging to other organizations within the same Grafana stack. Single-organization deployments are not affected. The vulnerability was published on August 17, 2026, and carries a CVSS v4.0 base score of 5.3 (Medium), assigned by Grafana Labs (GitHub Advisory, Grafana Advisory). Affected versions span Grafana OSS and Enterprise 11.2.0–11.6.16, 12.2.0–12.2.10, 12.3.0–12.3.8, 12.4.0–12.4.5, 13.0.0–13.0.3, and 13.1.0 (GitHub Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization): the access control check on the /api/access-control/users/permissions/search endpoint fails to properly scope results to the requesting user's organization, allowing data from other organizations to be returned (GitHub Advisory). Exploitation requires network access and a valid Org Admin account in at least one organization within the multi-org Grafana stack; no additional privileges or user interaction are needed. An attacker simply issues an authenticated HTTP GET request with the actionPrefix=dashboards: query parameter to retrieve cross-organization dashboard and folder UIDs along with per-user permission/scope mappings (Grafana Advisory).

Successful exploitation results in limited confidentiality impact: an Org Admin can enumerate dashboard and folder identifiers (UIDs) and discover which users hold which permissions across all organizations in the Grafana stack. Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. There is no integrity or availability impact, and the vulnerability does not enable lateral movement or code execution; however, the exposed permission mappings could assist an attacker in understanding the organizational structure and targeting specific users or dashboards for further social engineering or privilege escalation attempts (Grafana Advisory, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access as an Org Admin, which limits the attacker pool to insiders or compromised privileged accounts.

1. Obtain Org Admin credentials: Acquire valid credentials for a user with Org Admin privileges in any one organization within the target multi-org Grafana deployment (e.g., through phishing, credential stuffing, or insider access).
2. Authenticate to Grafana: Log in to the Grafana instance and obtain a valid session token or API key with Org Admin scope.
3. Query the vulnerable endpoint: Issue an authenticated HTTP GET request to the access control search API:

   GET /api/access-control/users/permissions/search?actionPrefix=dashboards:
   Authorization: Bearer <api_key_or_session_token>

4. Collect cross-organization data: Parse the API response, which will include dashboard and folder UIDs and per-user permission/scope mappings from organizations other than the attacker's own.
5. Enumerate targets: Use the disclosed UIDs and permission mappings to identify high-value dashboards or privileged users across other organizations for further reconnaissance or social engineering (Grafana Advisory, GitHub Advisory).

• Network: Repeated or anomalous authenticated HTTP GET requests to /api/access-control/users/permissions/search?actionPrefix=dashboards: originating from an Org Admin account, especially if the requesting user's organization does not typically use this endpoint.
• Logs: Grafana access logs showing requests to the above endpoint from accounts that are Org Admins of a single organization, particularly at unusual times or from unexpected IP addresses.
• Behavioral: A single Org Admin account making bulk or automated queries to the permissions search endpoint, which may indicate scripted enumeration of cross-organization data.

Grafana has released patched versions addressing this vulnerability. Users should upgrade to versions beyond the affected ranges: above 11.6.16 (for the 11.x branch), above 12.2.10, 12.3.8, 12.4.5 (for respective 12.x branches), above 13.0.3, and above 13.1.0 (Grafana Advisory). As an interim workaround where immediate patching is not possible, administrators should implement network-level controls or API gateway restrictions to limit access to the /api/access-control/users/permissions/search endpoint, and review whether Org Admin accounts truly require access to this API. Additionally, audit existing Org Admin assignments to minimize the number of accounts that could exploit this endpoint.