{"schemaVersion":3,"id":"CVE-2026-13720","aliases":["CGA-3r36-h83p-fp99","CGA-63rg-wvhc-vjhq","CGA-8m2m-jprx-xmx5","CGA-c7h5-hcfw-6v8w","CGA-f957-xcf4-m4vj","CGA-g2qw-3m38-m6r4","CGA-gx65-vxvh-2pfc","CGA-r449-wv57-2jrc","CGA-2229-vj79-93w4","CGA-3338-h2v3-pgj7","CGA-4fvr-3h54-c8fg","CGA-5wf2-pc4f-chfr","CGA-6hpq-8w66-rg5x","CGA-6vxm-jpjp-j7q6","CGA-7p2w-c474-78g7","CGA-8j7w-9p4f-jxmm","CGA-96vc-hvfh-9mpm","CGA-fff4-rhp6-33xx","CGA-jgv3-fv7r-hg73","CGA-m78x-5489-ccw4","CGA-pcfv-xxgh-q682","CGA-q7r4-483g-fmhj","CGA-qh2w-76j3-gqvp","CGA-qxrp-g86c-7wg7","CGA-rf54-h4jf-m3fx","CGA-w4q8-ffj7-8xgm","CGA-w6wq-wcwx-gvq3","CGA-xqm2-846f-qx48"],"status":"published","duplicateOf":null,"title":null,"description":"An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.","dates":{"published":"2026-09-30T11:06:38.177Z","modified":"2026-09-30T15:28:07.969Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.4,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.4,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.4,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00157,"percentile":0.04425,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-01T00:00:00.000Z","score":0.00172,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00157,"percentile":0.04425}],"last30":[{"date":"2026-10-01T00:00:00.000Z","score":0.00172,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00157,"percentile":0.04425}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-285","name":"Improper Authorization","description":"The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/285.html"},{"id":"CWE-345","name":"Insufficient Verification of Data Authenticity","description":"The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/345.html"},{"id":"CWE-915","name":"Improperly Controlled Modification of Dynamically-Determined Object Attributes","description":"The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/915.html"}],"affected":[{"vendor":"chainguard","product":"grafana-12.2","name":"grafana-12.2","label":"grafana-12.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-12.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-12.3","name":"grafana-12.3","label":"grafana-12.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-12.3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.2","name":"grafana-fips-12.2","label":"grafana-fips-12.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"percona-grafana","name":"percona-grafana","label":"percona-grafana","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/percona-grafana","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"grafana-12.3","name":"grafana-12.3","label":"grafana-12.3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/grafana-12.3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"grafana","product":"grafana enterprise","name":"Grafana Enterprise","label":"grafana enterprise","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 12.0.0, ≤ 12.0.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 12.1.0, ≤ 12.1.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 12.2.0, ≤ 12.2.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 12.3.0, ≤ 12.3.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 12.4.0, < 12.4.12","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.0.0, < 13.0.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.1.0, < 13.1.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.2.0, < 13.2.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 12.0.0, ≤ 12.0.10 | ≥ 12.1.0, ≤ 12.1.10 | ≥ 12.2.0, ≤ 12.2.11 | ≥ 12.3.0, ≤ 12.3.11 | ≥ 12.4.0, < 12.4.12 | ≥ 13.0.0, < 13.0.10 | ≥ 13.1.0, < 13.1.7 | ≥ 13.2.0, < 13.2.3","eol":null,"hubHref":"/vendor/grafana/grafana_enterprise"},{"vendor":"grafana","product":"grafana oss","name":"Grafana OSS","label":"grafana oss","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 12.0.0, ≤ 12.0.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 12.1.0, ≤ 12.1.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 12.2.0, ≤ 12.2.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 12.3.0, ≤ 12.3.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 12.4.0, < 12.4.12","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.0.0, < 13.0.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.1.0, < 13.1.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.2.0, < 13.2.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 12.0.0, ≤ 12.0.10 | ≥ 12.1.0, ≤ 12.1.10 | ≥ 12.2.0, ≤ 12.2.11 | ≥ 12.3.0, ≤ 12.3.11 | ≥ 12.4.0, < 12.4.12 | ≥ 13.0.0, < 13.0.10 | ≥ 13.1.0, < 13.1.7 | ≥ 13.2.0, < 13.2.3","eol":null,"hubHref":"/vendor/grafana/grafana_oss"}],"affectedCount":7,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-13720","label":"grafana.com/security/security-advisories/cve-2026-13720","hostname":"grafana.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":["RHSA-2026:74164","RHSA-2026:76430","RHSA-2026:76448"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-30T11:06:38.177Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-30T15:28:07.969Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":22,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T18:50:45.847Z","stale":false,"partial":false}}