GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
CVE-2026-16491medium6.5

CVE-2026-16491 CVE Record

Impact

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.

Source excerpt · GRAFANA
Applies when

The fix requires permission on the specified folder, an ancestor, or a wildcard scope.

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

Grafana · Grafana Enterprise

Other versions: unaffected

Version / rangeSource status
13.0.0 through 13.0.4 (inclusive)affected
13.1.0 through 13.1.1 (inclusive)affected
GRAFANA version evidence

Grafana · Grafana Enterprise

Platforms: Windows, Linux, macOS

Other versions: unaffected

Version / rangeSource status
13.0.0 through 13.1.0 (inclusive)affected
GRAFANA version evidence

Grafana · Grafana OSS

Other versions: unaffected

Version / rangeSource status
13.0.0 through 13.1.1 (inclusive)affected
GRAFANA version evidence

Original source description

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.

This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.

References