{"id":"EUVD-2026-23011","enisaUuid":"4e3c4bdf-492b-37b4-ad4a-f2da31d9eb26","description":"A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id \u003d 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in \u003e\u003d11.6.11, \u003e\u003d12.0.9, \u003e\u003d12.1.6, and \u003e\u003d12.2.4.\n\nThanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.","datePublished":"Apr 15, 2026, 6:57:25 PM","dateUpdated":"Aug 27, 2026, 5:22:44 PM","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","references":"https://grafana.com/security/security-advisories/cve-2026-21727\n","aliases":"CVE-2026-21727\nGHSA-p5x9-j974-rpfp\n","assigner":"GRAFANA","epss":0.2,"enisaIdProduct":[{"id":"36da260c-8391-3dbc-9a42-093665e9a015","product":{"name":"Grafana Correlations","vendor":{"name":"Grafana"}},"product_version":"10.2.0 \u003c12.4.0"}],"enisaIdVendor":[{"id":"1b8d7f50-3d5d-3edf-9ec8-ea9837000083","vendor":{"name":"Grafana"}}],"enisaIdVulnerability":[{"id":"b3ef5770-9283-3b83-9a35-2888a1be0c16","vulnerability":{"id":"GHSA-p5x9-j974-rpfp","description":"Grafana legacy correlations allow cross-tenant disclosure and deletion","datePublished":"Apr 15, 2026, 9:30:18 PM","dateUpdated":"Oct 5, 2026, 10:33:25 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-21727\nhttps://github.com/grafana/grafana/commit/2b2847625b8a77ba47128ccb5ecbcd72542cb9bc\nhttps://github.com/grafana/grafana/commit/2cf0dd6fde3f5a2b92864e2376ae5378c7df45e2\nhttps://github.com/grafana/grafana/commit/4010ee30bb441bc399a1f37bdc8ab55ec909f3b7\nhttps://github.com/grafana/grafana/commit/8e7ea333991d913298bd68d4787da9c6977a0a8c\nhttps://github.com/grafana/grafana/commit/a9a98fc4327182d1bdb9a74b5c2938d5c127e764\nhttps://github.com/grafana/grafana/commit/e702db6096e0509ff2825f732697f077e9e6289f\nhttps://github.com/grafana/grafana\nhttps://grafana.com/security/security-advisories/cve-2026-21727\n","enisa_id":"EUVD-2026-23011\n","aliases":"CVE-2026-21727\nGHSA-p5x9-j974-rpfp\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:59:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"df8c1fa9-07be-38c3-8c89-90877d689195","vulnerability":{"id":"CVE-2026-21727","description":"A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id \u003d 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in \u003e\u003d11.6.11, \u003e\u003d12.0.9, \u003e\u003d12.1.6, and \u003e\u003d12.2.4.\n\nThanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.","datePublished":"Apr 15, 2026, 6:57:25 PM","dateUpdated":"Aug 27, 2026, 5:22:44 PM","status":"PUBLISHED","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","references":"https://grafana.com/security/security-advisories/cve-2026-21727\n","enisa_id":"EUVD-2026-23011\n","assigner":"GRAFANA","epss":0.2,"dataProcessed":"Nov 1, 2026, 4:06:55 AM","vulnerabilityProduct":[{"id":"517056e9-9979-39aa-aeb0-4f0d5cf8f3f5","product":{"name":"Grafana Correlations","vendor":{"name":"Grafana"}},"product_version":"10.2.0 \u003c12.4.0"}],"vulnerabilityVendor":[{"id":"e6f2db04-c0c4-3a9f-9b18-e69493b55fc0","vendor":{"name":"Grafana"}}]}}],"enisaIdAdvisory":[{"id":"4464f82e-c7d8-3b06-81e9-52805bcc24b4","advisory":{"id":"WID-SEC-W-2026-0300","description":"Grafana: Schwachstelle ermöglicht Manipulation von Dateien und Offenlegung von Informationen","summary":"Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Grafana ausnutzen, um Dateien zu manipulieren und vertrauliche Informationen offenzulegen.","datePublished":"Feb 3, 2026, 11:00:00 PM","dateUpdated":"Feb 3, 2026, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0300.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-0300\n","aliases":"CVE-2026-21727\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"0d8eff2f-ad16-3320-a434-fe30ab69097e","product":{"name":"12.3.3","vendor":{"name":"Grafana"}}},{"id":"46e0061e-4b8f-365d-8f79-f0fde47b8ce6","product":{"name":"12.0.9","vendor":{"name":"eclipse"}}},{"id":"6dbbf7be-f490-3844-a495-f6133fbe4918","product":{"name":"12.2.4","vendor":{"name":"SolarWinds "}}},{"id":"acd1a98f-b2cb-3586-8e96-1736f3c106dc","product":{"name":"11.6.11","vendor":{"name":"Grafana"}}},{"id":"b15ea2c9-13aa-3141-90b0-f45be882fed6","product":{"name":"12.1.6","vendor":{"name":"Grafana"}}},{"id":"cd57a80d-797f-3d12-8fcd-4e15098d4ce0","product":{"name":"Grafana","vendor":{"name":"Grafana"}}}]}}]}