CVE-2026-19197 — Broken access control in dashboard snapshots
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's sec…
Published: 2026-08-26 · CVSS: 6.3 · CVSS 3.1
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7