« Volver al listado

CVE-2026-19197

Estado: Pendiente de análisisMedia (6.3)—

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Grafana — GrafanaAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-19197",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-19197",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-26T13:42:34.663264Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@grafana.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@grafana.com",
      "affectedData": [
        {
          "vendor": "Grafana",
          "product": "Grafana OSS",
          "versions": [
            {
              "status": "affected",
              "version": "12.4.0",
              "lessThan": "12.4.8",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "13.0.0",
              "lessThan": "13.0.6",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "13.1.0",
              "lessThan": "13.1.3",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Grafana",
          "product": "Grafana Enterprise",
          "versions": [
            {
              "status": "affected",
              "version": "12.4.0",
              "lessThan": "12.4.8",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "13.0.0",
              "lessThan": "13.0.6",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "13.1.0",
              "lessThan": "13.1.3",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-08-26T09:16:45.727",
  "references": [
    {
      "url": "https://grafana.com/security/security-advisories/cve-2026-19197",
      "source": "security@grafana.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@grafana.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control)."
    }
  ],
  "lastModified": "2026-08-31T18:50:00.053",
  "sourceIdentifier": "security@grafana.com"
}