# CVE-2026-21721: Grafana privilege escalation in dashboard permissions API

Source: https://junglewise.ai/threats/cve-2026-21721-grafana-privilege-escalation-in-dashboard-permissions-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-27. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-21721 · Severity: high · CVSS 8.1 · Published 2026-01-27

Grafana, a popular data visualization and monitoring platform, contains a security flaw in how it manages dashboard permissions. An internal user who has been granted permission to manage just one specific dashboard can exploit this bug to view or modify the permissions of any other dashboard in the organization. This could lead to unauthorized access to sensitive operational data or the accidental exposure of private monitoring information to the wrong users.

Technologies: [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-21721 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-21721 being exploited in the wild.

**How severe is CVE-2026-21721?** High severity, with a CVSS score of 8.1, published 27 January 2026.

**Which products and versions are affected?** Red Hat Enterprise Linux AppStream 9, 10.

**Is there a fix for CVE-2026-21721?** A patch was published on 2026-02-18: Red Hat released security updates for RHEL 9 and 10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-21721 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-21721?** Check whether you run Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass vulnerability (CWE-639/CWE-863) exists in the Grafana dashboard permissions API. The root cause is that the API only checks for the general 'dashboards.permissions:*' action without verifying if the user has authority over the specific target dashboard ID being modified. A remote authenticated attacker with low privileges (specifically, permission management rights on at least one dashboard) can send crafted API requests to read or modify the access control lists (ACLs) of any other dashboard. This results in an organization-internal privilege escalation. Patches have been released by Grafana Labs and downstream vendors like Red Hat.

## Affected products

- Grafana Labs Grafana >=12.3.0 <12.3.1+security-01, >=12.2.0 <12.2.3+security-01, >=12.1.0 <12.1.5+security-01, >=12.0.0 <12.0.8+security-01, >=10.2.0 <11.6.9+security-01
- Red Hat Red Hat Enterprise Linux AppStream 9, 10
- Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.12, 2.13
- Red Hat Red Hat Ceph Storage 5, 6, 8

## Timeline

- 2026-01-27: disclosed: Vulnerability reported via bug bounty program and published by Grafana Labs
- 2026-01-27: advisory
- 2026-02-18: patched: Red Hat released security updates for RHEL 9 and 10

## References

- [https://grafana.com/security/security-advisories/cve-2026-21721](https://grafana.com/security/security-advisories/cve-2026-21721)
- [https://access.redhat.com/errata/RHSA-2026:2914](https://access.redhat.com/errata/RHSA-2026:2914)
- [https://access.redhat.com/errata/RHSA-2026:2920](https://access.redhat.com/errata/RHSA-2026:2920)
- [https://access.redhat.com/errata/RHSA-2026:3078](https://access.redhat.com/errata/RHSA-2026:3078)
- [https://access.redhat.com/errata/RHSA-2026:3529](https://access.redhat.com/errata/RHSA-2026:3529)
- [https://access.redhat.com/errata/RHSA-2026:5633](https://access.redhat.com/errata/RHSA-2026:5633)
- [https://access.redhat.com/errata/RHSA-2026:8229](https://access.redhat.com/errata/RHSA-2026:8229)

## Related threats

- [CESNET libyang heap buffer overflow in lyb_read_string](https://junglewise.ai/threats/cve-2026-44673-cesnet-libyang-heap-buffer-overflow-in-lyb-read-string)
- [dnsmasq heap out-of-bounds read in extract_addresses](https://junglewise.ai/threats/cve-2026-5172-dnsmasq-heap-out-of-bounds-read-in-extract-addresses)
- [dnsmasq heap out-of-bounds read in DNSSEC validation](https://junglewise.ai/threats/cve-2026-4891-dnsmasq-heap-out-of-bounds-read-in-dnssec-validation)
- [dnsmasq infinite loop in DNSSEC NSEC parsing](https://junglewise.ai/threats/cve-2026-4890-dnsmasq-infinite-loop-in-dnssec-nsec-parsing)
- [PHP DOMNode::C14N() denial of service via circular linked list](https://junglewise.ai/threats/cve-2026-7263-php-domnode-c14n-denial-of-service-via-circular-linked-list)