CVE-2026-82014: 
Grafana vulnerability analysis and mitigation

CVE-2026-82014 is a missing authorization vulnerability in Grafana OSS and Grafana Enterprise that allows any authenticated user — including those with the lowest-privilege Viewer role — to modify team preferences (home dashboard, theme, timezone) via an undocumented, unprotected API endpoint. It affects Grafana OSS and Enterprise versions 5.4.0 through 11.5.10, 11.6.0–11.6.16, 12.0.0–12.0.10, 12.1.0–12.1.10, 12.2.0–12.2.11, 12.3.0–12.3.11, 12.4.0–12.4.14, and 13.0.0–13.0.12. The vulnerability was published on November 11, 2026, with a patch available the same day. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Grafana Advisory).

The root cause is classified as CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), with an estimated secondary classification of CWE-862 (Missing Authorization). An undocumented API endpoint in Grafana that handles team preference updates performs no authorization checks, meaning any authenticated session — regardless of role — can send a crafted network request to modify team-level settings such as the home dashboard, UI theme, and timezone. The attack requires only valid credentials (low privilege), no user interaction, and is exploitable over the network with low complexity (GitHub Advisory, Grafana Advisory).

Successful exploitation allows a low-privileged authenticated attacker to redirect all members of any Grafana team to an arbitrary dashboard of the attacker's choosing, and to alter the visual theme and timezone for those teams. The primary impact is an integrity violation — unauthorized modification of team configuration — with no direct confidentiality or availability impact. In practice, this could be abused to redirect team members to a misleading or malicious dashboard, potentially facilitating social engineering or obscuring legitimate monitoring data (GitHub Advisory, Grafana Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is 0.0, reflecting a very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Authentication: Log in to the target Grafana instance with any valid account, including a Viewer-role account.
2. Identify target team: Enumerate available teams via the Grafana API (e.g., GET /api/teams/search) to obtain the numeric team ID of the target team.
3. Craft malicious request: Send an HTTP request to the undocumented team preferences endpoint (e.g., PUT /api/teams/<team_id>/preferences) with a JSON body specifying a controlled dashboard UID, theme, and timezone — bypassing any authorization check.
4. Redirect team members: All members of the targeted team will now have their Grafana home dashboard redirected to the attacker-specified dashboard upon next login or page load, potentially displaying misleading or attacker-controlled content (GitHub Advisory, Grafana Advisory).

• Network: Unexpected HTTP PUT or PATCH requests to /api/teams/<id>/preferences originating from low-privileged user accounts or accounts not normally associated with team administration.
• Logs: Grafana access logs showing team preference update API calls from Viewer-role users or from accounts outside the expected administrator group; repeated preference changes across multiple teams from a single account.
• Application: Unexplained changes to team home dashboards, themes, or timezones — especially if team members report being redirected to unfamiliar dashboards.

Grafana has released patched versions for all affected branches. Users should upgrade to: 11.5.11 or later (11.5.x), 11.6.17 or later (11.6.x), 12.0.11 or later (12.0.x), 12.1.11 or later (12.1.x), 12.2.12 or later (12.2.x), 12.3.12 or later (12.3.x), 12.4.15 or later (12.4.x), or 13.0.13 or later (13.0.x). If immediate patching is not feasible, implement network-level access controls to restrict access to the affected team preferences endpoints and monitor logs for unauthorized team preference modifications (Grafana Advisory, GitHub Advisory).