Grafana: Org Admin can read dashboard permission mappings belonging to other organizations

Impact

In a multi-organization stack, an Org Admin of one organization can call the access-control permission search endpoint with actionPrefix=dashboards: and receive data from other organizations. What comes back is dashboard and folder UIDs plus per-user permission and scope mappings — who holds which access on which dashboard. Grafana states dashboard contents, panels, query results, datasource credentials, secrets and personal data are not exposed. Where an operator uses Grafana orgs as the tenant boundary for fleet telemetry, this leaks the structure of other tenants' monitoring and the identities with access to it: reconnaissance for targeting, not a data breach. Single-organization deployments are not affected at all.

Who can reach it

An authenticated user holding Org Admin in any organization of a multi-org Grafana stack, over the network. No interaction from another user.

What to do

Apply the Grafana OSS / Enterprise release named in Grafana's advisory for CVE-2026-11817 and restart the Grafana service — the record does not carry the fixed version numbers, so read the advisory for your branch. Single-org stacks need no action, and there is no node-level work in either case.

References