CVE-2026-13720

Name of the Vulnerable Software and Affected Versions Grafana (affected versions not specified)

Description An Editor can set file-provisioning metadata when creating a dashboard through the dashboard API because certain fields are stored without an authorization check. This allows the creation of dashboards that appear as file-provisioned, preventing administrators from updating or deleting them through the interface. The impact is restricted to the same organization, and no data is exposed. The affected metadata includes the grafana.app/managedBy, grafana.app/managerId, and grafana.app/sourcePath annotations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.