CVE-2026-11817: Grafana Information Disclosure Vulnerability

CVE-2026-11817 Overview

CVE-2026-11817 is an authorization flaw in Grafana that affects multi-organization deployments. An authenticated Org Admin from one organization can call the GET /api/access-control/users/permissions/search endpoint with actionPrefix=dashboards: and receive permission metadata belonging to other organizations. The disclosed data covers dashboard and folder unique identifiers (UIDs) and per-user permission and scope mappings. Dashboard contents, panels, query results, datasource credentials, secrets, and personal data remain protected. Single-organization Grafana stacks are not affected. This weakness is tracked under CWE-863: Incorrect Authorization.

Critical Impact
An Org Admin scoped to one organization can enumerate dashboard UIDs, folder UIDs, and user-to-permission mappings across every organization in the Grafana stack.

Affected Products

Grafana multi-organization deployments
Grafana stacks exposing the /api/access-control/users/permissions/search endpoint
Single-organization Grafana deployments are NOT affected

Discovery Timeline

2026-08-17 - CVE-2026-11817 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-11817

Vulnerability Analysis

The vulnerability resides in the access-control search endpoint at /api/access-control/users/permissions/search. When an authenticated user with Org Admin privileges passes actionPrefix=dashboards: as a query parameter, the endpoint returns permission records without filtering results by the caller's organization scope. The result set includes permission entries owned by users in other organizations within the same Grafana stack.

The exposed data is limited to structural authorization metadata: dashboard UIDs, folder UIDs, and mappings that show which user holds which access level on which dashboard. Dashboard payloads, panel queries, query results, datasource credentials, and stored secrets remain inaccessible through this endpoint. The disclosure is therefore structural rather than content-level.

Root Cause

The endpoint fails to enforce organization-scoped authorization on the permission search action. This is a classic [CWE-863] incorrect authorization pattern: the caller is authenticated and authorized to perform the action within their own organization, but the server does not restrict the returned data set to that organization's boundary. Multi-tenant isolation collapses at the query layer.

Attack Vector

An attacker requires valid Org Admin credentials in at least one organization on the target Grafana stack. The attacker issues an authenticated HTTP GET request to /api/access-control/users/permissions/search?actionPrefix=dashboards: and parses the response. The response reveals cross-organization dashboard and folder UIDs plus user-to-permission bindings that would normally be hidden from the caller's organization scope. This reconnaissance can inform follow-on social engineering, targeted access requests, or privilege-mapping analysis. No user interaction is required and no additional exploit chain is needed.

Refer to the Grafana Security Advisory CVE-2026-11817 for vendor-supplied technical details.

Detection Methods for CVE-2026-11817

Indicators of Compromise

HTTP GET requests to /api/access-control/users/permissions/search containing the actionPrefix=dashboards: parameter from Org Admin accounts
Unusually large response payloads from the permissions search endpoint containing dashboard UIDs outside the caller's organization
Repeated calls to the endpoint by a single Org Admin account in a short time window suggesting enumeration

Detection Strategies

Enable Grafana access logging and correlate requests to /api/access-control/users/permissions/search with the caller's orgId and the UIDs returned in responses
Alert when an Org Admin retrieves permission records referencing organizations they are not a member of
Baseline the volume of access-control API calls per admin account and flag statistical outliers

Monitoring Recommendations

Forward Grafana application logs and reverse-proxy access logs to a centralized analytics pipeline for retention and query
Track authentication events for Org Admin accounts and correlate them with subsequent API activity
Review audit logs after applying the vendor patch to identify any prior enumeration attempts against the vulnerable endpoint

How to Mitigate CVE-2026-11817

Immediate Actions Required

Apply the patched Grafana release referenced in the Grafana Security Advisory CVE-2026-11817
Inventory Grafana stacks and identify those running with multiple organizations enabled
Review Org Admin role assignments and remove unused or over-privileged accounts
Rotate dashboard and folder UIDs where cross-organization disclosure is a compliance concern

Patch Information

Grafana Labs published a security advisory and patched release for this issue. Consult the Grafana Security Advisory CVE-2026-11817 for the specific fixed versions applicable to your deployment channel and upgrade path.

Workarounds

Consolidate to single-organization Grafana deployments where operationally feasible, since single-org stacks are not affected
Restrict access to the /api/access-control/users/permissions/search endpoint at the reverse proxy or WAF layer until the patch is applied
Reduce the number of Org Admin role assignments to the minimum required for operations

bash

# Example NGINX rule to block the vulnerable endpoint pre-patch
location = /api/access-control/users/permissions/search {
    return 403;
}