Grafana: folder-admin check ignores the folder, exposing deleted dashboards from other folders

Impact

Grafana's RBAC service did not take the requested folder into account when deciding whether a user is a folder administrator for listings of deleted dashboards. A user who holds dashboard permission-management rights on any one folder was therefore treated as an administrator of every folder, and could list deleted dashboard items from folders they have no access to. On a shared observability stack - the common pattern where each tenant or team owns its own folder - this breaks the folder boundary that the separation relies on, leaking dashboard titles and contents from other teams' deleted work. Confidentiality and integrity of the authorization decision only; no code execution and no effect on running GPU workloads.

Who can reach it

Authenticated Grafana user who already has dashboard permission-management rights on at least one folder (the record scores privileges required as high), over HTTP to the Grafana API.

What to do

Upgrade Grafana to the version named in the vendor advisory and restart the service; the fix makes the check require permission on the specified folder, an ancestor, or a wildcard scope. This record carries no fixed version - take it from grafana.com/security/security-advisories/cve-2026-16491. Single-service restart, no fleet maintenance window. Reviewing who holds folder-level permission-management rights is a sensible follow-up, since that is the privilege that was being over-honoured.

References

Related entries

• open-iscsi iscsiuio (DHCPv6 handling): Integer underflow and out-of-bounds read in iscsiuio's DHCPv6 handlingCVE-2026-18727 · open-iscsi iscsiuio (DHCPv6 handling)Medium
• Grafana: injected timeGroup macro in a SQL query exhausts memory and kills the server processCVE-2026-19475 · Grafana SQL data sources (regex macro parsing, timeGroup injected via WHERE clause)Medium
• Grafana: unbounded request body on the Prometheus rule conversion API crashes the server via out-of-memoryCVE-2026-33374 · Grafana Prometheus rule conversion APIMedium
• lldpd (802.1Q VLAN tag stripping in lldpd_decode): lldpd strips 802.1Q VLAN tags by memmove-ing the frame payload fourCVE-2026-46433 · lldpd (802.1Q VLAN tag stripping in lldpd_decode)Medium
• Apache Airflow: Bulk Variables API skips key-based redaction, returning JSON variable secrets in cleartextCVE-2026-48828 · Apache Airflow (Bulk Variables API, secrets masker key-based redaction)Medium
• Apache Airflow: Config API exposes secrets-backend kwargs overrides unmasked, leaking Vault credentialsCVE-2026-48892 · Apache Airflow (Config API, per-key secrets-backend environment overrides)Medium