UpHeron
All vulnerabilities

Servers and applications

CVE-2026-82014

Team preferences RBAC bypass through the set-home-dash endpoint

Severity
Medium 4.3
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Weakness
Mass assignment (CWE-915)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Change some data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Sources
CVE Program

Description

Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice (missing authorization).

From the CVE Program.

Affected software

SoftwareAffected versions
GrafanaServers and applications · cna:grafana|grafana enterprise
  • From 13.0.0 up to 13.0.12
  • From 12.4.0 up to 12.4.14
  • From 12.3.0 up to 12.3.11
  • From 12.2.0 up to 12.2.11
All 8 release lines
  • From 5.4.0 up to 11.5.10
  • From 11.6.0 up to 11.6.16
  • From 12.0.0 up to 12.0.10
  • From 12.1.0 up to 12.1.10
  • From 12.2.0 up to 12.2.11
  • From 12.3.0 up to 12.3.11
  • From 12.4.0 up to 12.4.14
  • From 13.0.0 up to 13.0.12

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-82014