Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Grafana | Grafana Enterprise | unaffected |
|
||||||||||||||||||
| Grafana | Grafana OSS | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 30 Sep 2026 11:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed. | |
| Title | Alert rules in restricted folders disclosed via the alert rules list API | |
| Weaknesses | CWE-200 CWE-863 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: GRAFANA
Published:
Updated: 2026-09-30T13:05:14.113Z
Reserved: 2026-06-29T14:10:37.534Z
Link: CVE-2026-13719
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-30T11:16:43.757
Modified: 2026-09-30T11:16:43.757
Link: CVE-2026-13719
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-09-30T13:00:16Z