CVE-2026-21721 — Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management r…
Published: 2026-01-27 · CVSS: 8.1 · CVSS 3.1
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7