Retour à la veille
CVE-2026-13720
Score CVSS
5.4
MEDIUM
Description détaillée
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.
Vecteur d'attaque (CVSS)
Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Références et Patchs
Dernières Vulnérabilités
CVE-2026-97302
Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.
VOIR DÉTAILS
CVE-2026-97301
Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.
VOIR DÉTAILS
CVE-2026-97299
Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.
VOIR DÉTAILS