MEDIUM 5.4 NVD

CVE-2026-13720

An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard

An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.

References

https://grafana.com/security/security-advisories/cve-2026-13720

Published: 2026-09-30 · Source: NVD · Feed updated: 2026-09-30

This medium severity vulnerability with a CVSS score of 5.4 was published on 2026-09-30 via NVD.

vulnfeed aggregates 9449 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.