CVE-2026-19197: 
Grafana vulnerability analysis and mitigation

CVE-2026-19197 is a broken access control vulnerability in Grafana OSS and Grafana Enterprise that allows an organization administrator to delete dashboard snapshots belonging to other organizations on the same Grafana instance, and to recover a snapshot's secret delete key using only its public share key. The vulnerability was published on August 26, 2026, and affects Grafana versions 12.4.0–12.4.7, 13.0.0–13.0.5, and 13.1.0–13.1.2. It carries a CVSS v3.1 base score of 6.3 (Medium) (Grafana Advisory, ENISA EUVD).

The root cause is classified as CWE-862 (Missing Authorization). The vulnerability arises because Grafana's snapshot management API does not properly enforce organizational boundaries when processing delete requests or when resolving secret delete keys from public share keys. An authenticated user with organization administrator privileges can craft API requests targeting snapshots owned by other organizations on the same multi-tenant Grafana instance, bypassing the expected tenant isolation controls. No public proof-of-concept code has been identified at this time (Grafana Advisory, ENISA EUVD).

Successful exploitation allows a malicious organization administrator to delete dashboard snapshots belonging to other organizations (integrity and availability impact) and to recover secret delete keys from public share keys, potentially enabling unauthorized deletion of snapshots shared externally (confidentiality and integrity impact). The scope is limited to the Grafana instance itself and does not directly enable lateral movement to underlying infrastructure, but cross-organization data exposure within a shared Grafana deployment is a concrete risk. The CVSS assessment reflects low-level impacts across confidentiality, integrity, and availability (Grafana Advisory).

No active in-the-wild exploitation has been reported, and the NVD SSVC assessment indicates exploitation status as "none" and the vulnerability is not automatable. The EPSS score is approximately 0.202%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access with organization administrator privileges, limiting the attack surface (ENISA EUVD).

1. Reconnaissance: Identify a target Grafana instance running an affected version (12.4.0–12.4.7, 13.0.0–13.0.5, or 13.1.0–13.1.2) with multi-organization configuration enabled.
2. Obtain credentials: Authenticate to the Grafana instance as an organization administrator (either through legitimate access or compromised credentials).
3. Enumerate snapshots: Use the Grafana API (e.g., GET /api/dashboard/snapshots) or the UI to enumerate dashboard snapshots, including those belonging to other organizations on the same instance.
4. Recover secret delete key: Using a known public share key of a target snapshot, craft an API request to recover the associated secret delete key, exploiting the missing authorization check.
5. Delete cross-organization snapshots: Use the recovered secret delete key or direct API calls to delete dashboard snapshots belonging to other organizations, bypassing tenant isolation controls (Grafana Advisory).

• Logs: Grafana audit logs showing an organization administrator account issuing snapshot delete API calls (DELETE /api/snapshots/{key}) against snapshot keys not belonging to their own organization; API requests to resolve secret delete keys from public share keys by accounts outside the owning organization.
• Network: Unusual volume of snapshot-related API requests (GET/DELETE) from a single authenticated session, particularly targeting snapshot endpoints across multiple organizations.
• Behavioral: Unexpected deletion of dashboard snapshots reported by users in organizations that did not initiate the deletion; organization administrators accessing snapshot management endpoints for organizations they do not belong to.

Grafana has released patched versions addressing this vulnerability: 12.4.8, 13.0.6, and 13.1.3 for both Grafana OSS and Grafana Enterprise. Organizations should upgrade to one of these fixed versions as the primary remediation. As a temporary workaround, restricting organization administrator privileges to trusted users only and auditing snapshot sharing practices can reduce exposure until patching is feasible (Grafana Advisory, ENISA EUVD).