CVE-2026-81842: 
Grafana vulnerability analysis and mitigation

CVE-2026-81842 is an incorrect authorization vulnerability in Grafana's library elements API that allows an authenticated user with edit permission on one folder to move a library panel into another folder where they only have view permission. The flaw affects Grafana OSS and Grafana Enterprise versions 12.1.0–12.1.10, 12.2.0–12.2.11, 12.3.0–12.3.11, 12.4.0–12.4.11, and 13.0.0–13.0.9. It was published on September 29, 2026, with patches released the same day. The CVSS v3.1 base score is 4.3 (Medium) (GitHub Advisory, Grafana Advisory).

The root cause is an incorrect authorization check (CWE-863) combined with an authorization bypass through a user-controlled key (CWE-639) in the library elements update path. When a user moves a library panel via the library elements API or the equivalent App Platform resource, the server fails to verify that the requesting user holds create permission on the destination folder — only the source folder's edit permission is validated. This allows an authenticated low-privileged user to place content into folders they are not authorized to write to by crafting an API request specifying a destination folder ID they control as a parameter (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an authenticated attacker to move library panels into folders for which they only have view-level access, violating the intended access control model. Grafana explicitly notes that no data from the destination folder is disclosed and existing content there cannot be modified, limiting the impact to a low-integrity violation with no confidentiality or availability consequences. The practical risk is unauthorized placement of content (library panels) in restricted organizational folders, which could cause confusion or policy violations in multi-tenant or role-segregated Grafana deployments (GitHub Advisory, Grafana Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Grafana Advisory). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a valid authenticated session with at least edit permission on one folder, limiting the attack surface to internal or authenticated users.

1. Authenticate: Obtain valid Grafana credentials for an account that has edit permission on at least one folder (Folder A) but only view permission on a target folder (Folder B).
2. Identify target folder: Enumerate folder IDs via the Grafana API (e.g., GET /api/folders) to identify the UID or ID of the restricted destination folder (Folder B).
3. Identify a library panel: List library panels in Folder A using GET /api/library-elements to obtain the UID of a panel to move.
4. Craft the move request: Send a PATCH /api/library-elements/{uid} request with a JSON body specifying the destination folder's UID (Folder B), e.g., {"folderUid": "<folder-b-uid>", "name": "<panel-name>", "model": {...}}.
5. Bypass authorization: Because the server only checks edit permission on the source folder and not create permission on the destination, the request succeeds and the library panel is moved into Folder B.
6. Verify: Confirm the panel now appears in Folder B via GET /api/library-elements?folderFilterUIDs=<folder-b-uid> (GitHub Advisory, Grafana Advisory).

• Network/API Logs: PATCH /api/library-elements/{uid} requests where the authenticated user's role on the destination folderUid is viewer-only; repeated such requests from a single user account targeting multiple restricted folders.
• Grafana Audit Logs: Audit log entries showing a library element update (library-element-updated event) with a destination folder UID that the user does not have create/edit permissions on.
• Application Logs: Grafana server logs recording successful library panel moves to folders inconsistent with the user's assigned permissions, without corresponding permission-denied errors.

Grafana has released patched versions addressing this vulnerability: 12.1.11, 12.2.12, 12.3.12, 12.4.12, and 13.0.10. Organizations should upgrade to the appropriate patched release as the primary remediation (Grafana Advisory, GitHub Advisory). As a temporary workaround until patching is possible, restrict API access to the library elements endpoint (/api/library-elements) and equivalent App Platform resources to trusted administrative users only, using network-level controls or Grafana's API key/service account permission management.