CVE and update status of the FreeBSD ports tree3,614 unaddressed CVEs in 711 portsAll times are CET
CVE details

CVE-2026-16491

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.

Score
6.5 medium
Published
2026-10-27
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
www/grafanagrafana13.1.1_5unaddresseddrtr0jan@yandex.ru

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>grafana</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Grafana’s RBAC service ignored the requested folder when checking
	whether a user was a folder administrator for deleted dashboard
	listings. A user with dashboard permission-management rights on any
	folder could therefore be treated as an administrator of every
	folder.

This could expose deleted dashboard items from folders where
	the user lacked administrative access. The fix requires permission on
	the specified folder, an ancestor, or a wildcard scope.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-16491</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-16491</url>
    </references>
    <dates>
      <discovery>2026-10-27</discovery>
      <entry>2026-10-27</entry>
    </dates>
  </vuln>