CVE-2026-13720 — Editor can forge file-provisioning provenance on dashboards via the dashboard API
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dash…
Published: 2026-09-30 · CVSS: 5.4 · CVSS 3.1
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7