CVE-2026-33377
Full vulnerability record from the local CVENow database.
Description
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
Severity
HIGH
CVSS score
7.1
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-05-13 20:16:20.470000
Last modified
2026-10-26 14:10:00.130000
View original CVE JSON
{
"id": "CVE-2026-33377",
"sourceIdentifier": "[email protected]",
"published": "2026-05-13T20:16:20.470",
"lastModified": "2026-10-26T14:10:00.130",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege."
},
{
"lang": "es",
"value": "Un Editor puede sobrescribir un panel de control que no les pertenece para adquirir privilegios de administrador en ese panel de control específico. El usuario debe tener acceso de escritura al panel de control para escalar privilegios."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Grafana",
"product": "Grafana OSS",
"defaultStatus": "unaffected",
"versions": [
{
"version": "8.5.0",
"lessThanOrEqual": "11.6.14",
"versionType": "semver",
"status": "affected"
},
{
"version": "11.6.14",
"lessThan": "11.6.14+security-04",
"versionType": "custom",
"status": "affected"
},
{
"version": "12.0.0",
"lessThanOrEqual": "12.2.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.2.8",
"lessThan": "12.2.8+security-04",
"versionType": "custom",
"status": "affected"
},
{
"version": "12.3.0",
"lessThanOrEqual": "12.3.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.3.6",
"lessThan": "12.3.6+security-04",
"versionType": "custom",
"status": "affected"
},
{
"version": "12.4.0",
"lessThanOrEqual": "12.4.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.4.3",
"lessThan": "12.4.3+security-02",
"versionType": "custom",
"status": "affected"
},
{
"version": "13.0.0",
"lessThanOrEqual": "13.0.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "13.0.1",
"lessThan": "13.0.1+security-01",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 4.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-16T03:55:59.661383Z",
"id": "CVE-2026-33377",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.5.0",
"versionEndExcluding": "11.6.14",
"matchCriteriaId": "3EB52192-B43E-44FD-A838-245DD579DF4E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.2.0",
"versionEndExcluding": "12.2.8",
"matchCriteriaId": "37747AB2-8B5F-4BD3-860E-0C092A9F78F0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.3.0",
"versionEndExcluding": "12.3.6",
"matchCriteriaId": "870FE01F-86F1-4734-9CC3-6FC9AF3012C5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.4.0",
"versionEndExcluding": "12.4.3",
"matchCriteriaId": "4451FBC6-6277-4DD8-B143-0DAE82175D9A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:11.6.14:-:*:*:*:*:*:*",
"matchCriteriaId": "548C63DC-4E7F-4D9E-B2F0-AB24A66E0F7F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:11.6.14:security01:*:*:*:*:*:*",
"matchCriteriaId": "5F103470-1371-498E-9442-11EA7C2E3A6B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.2.8:-:*:*:*:*:*:*",
"matchCriteriaId": "4ACC0DB6-8BC4-4975-AD26-D41F69571EF6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.2.8:security01:*:*:*:*:*:*",
"matchCriteriaId": "9EBE773D-17BB-4402-B0B8-74D3DD79B32C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.3.6:-:*:*:*:*:*:*",
"matchCriteriaId": "6A58801D-1713-4A52-8713-9DD31F75698D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.3.6:security01:*:*:*:*:*:*",
"matchCriteriaId": "5C930B25-FD06-477C-B226-DEB486A46DAA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.4.3:-:*:*:*:*:*:*",
"matchCriteriaId": "172F03B1-E693-4EF3-90A0-D40773E4ACB4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:13.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0F0B8E4F-ADE7-4594-9241-966B1F0BC440"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:13.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "2AD87DC5-DF20-4993-A11B-91EBB313A40A"
}
]
}
]
}
],
"references": [
{
"url": "https://grafana.com/security/security-advisories/cve-2026-33377",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}