CVE-2026-13720: Grafana Enterprise

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.

Affected products

• Grafana Grafana Enterprise: from 12.0.0, up to and including 12.0.10; from 12.1.0, up to and including 12.1.10; from 12.2.0, up to and including 12.2.11; from 12.3.0, up to and including 12.3.11; from 12.4.0, before 12.4.12 (fixed in 12.4.12); from 13.0.0, before 13.0.10 (fixed in 13.0.10); …
• Grafana Grafana OSS: from 12.0.0, up to and including 12.0.10; from 12.1.0, up to and including 12.1.10; from 12.2.0, up to and including 12.2.11; from 12.3.0, up to and including 12.3.11; from 12.4.0, before 12.4.12 (fixed in 12.4.12); from 13.0.0, before 13.0.10 (fixed in 13.0.10); …

Published 2026-09-30. Last modified 2026-09-30.