CVE-2026-11817

Name of the Vulnerable Software and Affected Versions Grafana (affected versions not specified)

Description In deployments configured with multiple organizations, an Org Admin of a single organization can access permission data from other organizations. This occurs when calling the 'GET /api/access-control/users/permissions/search' endpoint using the actionPrefix parameter set to 'dashboards:'. The exposed information is limited to dashboard and folder identifiers (UIDs) and per-user permission or scope mappings. This issue does not expose dashboard contents, panels, query results, datasource credentials, secrets, or personal data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.