CVE-2026-21722 (GCVE-0-2026-21722)

Vulnerability from cvelistv5 – Published: 2026-02-12 08:49 – Updated: 2026-03-27 14:28
VLAI?
Title
Public Dashboards time range restriction on annotations can be bypassed
Summary
Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any annotations that would not otherwise be visible on the public dashboard.
Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-863 - Incorrect Authorization
Assigner
References
Impacted products
Vendor Product Version
Grafana grafana/grafana Affected: 9.3.0 , < 11.6.10+security-01 (semver)
Affected: 12.0.0 , < 12.1.6+security-01 (semver)
Affected: 12.2.0 , < 12.2.4+security-01 (semver)
Affected: 12.3.0 , < 12.3.2+security-01 (semver)
Create a notification for this product.
    Grafana grafana/grafana-enterprise Affected: 9.3.0 , < 11.6.10+security-01 (semver)
Affected: 12.0.0 , < 12.1.6+security-01 (semver)
Affected: 12.2.0 , < 12.2.4+security-01 (semver)
Affected: 12.3.0 , < 12.3.2+security-01 (semver)
Create a notification for this product.
Date Public ?
2026-02-12 07:13
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21722",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-12T14:24:06.337064Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-863",
                "description": "CWE-863 Incorrect Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-27T14:01:13.177Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "grafana/grafana",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "11.6.10+security-01",
              "status": "affected",
              "version": "9.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.1.6+security-01",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.2.4+security-01",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.3.2+security-01",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "grafana/grafana-enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "11.6.10+security-01",
              "status": "affected",
              "version": "9.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.1.6+security-01",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.2.4+security-01",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.3.2+security-01",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-02-12T07:13:06.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange.\n\nThis did not leak any annotations that would not otherwise be visible on the public dashboard."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-27T14:28:52.218Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-21722"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Public Dashboards time range restriction on annotations can be bypassed",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-21722",
    "datePublished": "2026-02-12T08:49:05.678Z",
    "dateReserved": "2026-01-05T09:26:06.214Z",
    "dateUpdated": "2026-03-27T14:28:52.218Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-21722\",\"sourceIdentifier\":\"security@grafana.com\",\"published\":\"2026-02-12T09:16:08.763\",\"lastModified\":\"2026-02-27T15:16:27.600\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange.\\n\\nThis did not leak any annotations that would not otherwise be visible on the public dashboard.\"},{\"lang\":\"es\",\"value\":\"Los paneles p\u00fablicos con anotaciones habilitadas no limitaban su rango de tiempo de anotaciones al rango de tiempo bloqueado del panel p\u00fablico. Esto significaba que se pod\u00eda leer todo el historial de anotaciones visibles en el panel espec\u00edfico, incluso aquellas fuera del rango de tiempo bloqueado.\\n\\nEsto no filtraba ninguna anotaci\u00f3n que de otro modo no ser\u00eda visible en el panel p\u00fablico.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@grafana.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.3.0\",\"versionEndExcluding\":\"11.6.10\",\"matchCriteriaId\":\"FC76AD1C-B27B-406D-A117-4A77843DB73E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"12.0.0\",\"versionEndExcluding\":\"12.1.6\",\"matchCriteriaId\":\"D5BEDACC-A177-4E74-B3A7-262519FEE855\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"12.2.0\",\"versionEndIncluding\":\"12.2.4\",\"matchCriteriaId\":\"1A9AE662-36F4-4B97-8B4C-78E93587D100\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"12.3.0\",\"versionEndIncluding\":\"12.3.2\",\"matchCriteriaId\":\"97D48B2B-3863-409D-BC93-778972C04854\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:grafana:11.6.10:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6CAA7A9-874F-4C6A-B955-4DFBA2834355\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:grafana:12.1.6:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"47FF05E9-65D7-43E8-93B0-111BA4708041\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:grafana:12.2.4:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"4CF2D10C-CEE9-4D8C-9D46-F38DE3540FB5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:grafana:12.3.2:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"63FB712A-04AC-42FD-AC3C-1384932B662E\"}]}]}],\"references\":[{\"url\":\"https://grafana.com/security/security-advisories/cve-2026-21722\",\"source\":\"security@grafana.com\",\"tags\":[\"Broken Link\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-21722\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-12T14:24:06.337064Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-863\", \"description\": \"CWE-863 Incorrect Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-12T14:24:11.898Z\"}}], \"cna\": {\"title\": \"Public Dashboards time range restriction on annotations can be bypassed\", \"source\": {\"discovery\": \"BUG_BOUNTY\"}, \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\"}}], \"affected\": [{\"vendor\": \"Grafana\", \"product\": \"grafana/grafana\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.3.0\", \"lessThan\": \"11.6.10+security-01\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"12.0.0\", \"lessThan\": \"12.1.6+security-01\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"12.2.0\", \"lessThan\": \"12.2.4+security-01\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"12.3.0\", \"lessThan\": \"12.3.2+security-01\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Grafana\", \"product\": \"grafana/grafana-enterprise\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.3.0\", \"lessThan\": \"11.6.10+security-01\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"12.0.0\", \"lessThan\": \"12.1.6+security-01\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"12.2.0\", \"lessThan\": \"12.2.4+security-01\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"12.3.0\", \"lessThan\": \"12.3.2+security-01\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-02-12T07:13:06.000Z\", \"references\": [{\"url\": \"https://grafana.com/security/security-advisories/cve-2026-21722\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange.\\n\\nThis did not leak any annotations that would not otherwise be visible on the public dashboard.\"}], \"providerMetadata\": {\"orgId\": \"57da9224-a3e2-4646-9d0e-c4dc2e05e7da\", \"shortName\": \"GRAFANA\", \"dateUpdated\": \"2026-03-26T21:41:05.350Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-21722\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-26T21:41:05.350Z\", \"dateReserved\": \"2026-01-05T09:26:06.214Z\", \"assignerOrgId\": \"57da9224-a3e2-4646-9d0e-c4dc2e05e7da\", \"datePublished\": \"2026-02-12T08:49:05.678Z\", \"assignerShortName\": \"GRAFANA\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.