{"id":"CVE-2026-16491","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-16491","generatedAt":"2026-10-28T02:19:59.029Z","title":"This could expose deleted dashboard items from folders where the user lacked administrative access.","description":"Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.\n\nThis could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.","published":"2026-10-27T18:17:37.000Z","lastModified":"2026-10-27T18:17:37.000Z","status":"Received","sourceIdentifier":"security@grafana.com","cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"},"cwe":["CWE-862"],"affected":[],"epss":null,"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and no EPSS score yet. Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-27T18:17:37.000Z","detail":{"score":"6.5","severity":"MEDIUM","publishedAt":"2026-10-27T18:17:37.053Z"},"summary":"New CVE, medium severity (CVSS 6.5)."}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-16491","source":"security@grafana.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-16491","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}