CVE-2026-13719

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://grafana.com/security/security-advisories/cve-2026-13719

Configurations

No configuration.

History

30 Sep 2026, 11:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-30 11:16

Updated : 2026-09-30 17:23

NVD link : CVE-2026-13719

Mitre link : CVE-2026-13719

CVE.ORG link : CVE-2026-13719

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-863

Incorrect Authorization

{"id": "CVE-2026-13719", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13719", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T14:29:01.284869Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@grafana.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@grafana.com", "affectedData": [{"vendor": "Grafana", "product": "Grafana Enterprise", "versions": [{"status": "affected", "version": "12.3.0", "versionType": "semver", "lessThanOrEqual": "12.3.11"}, {"status": "affected", "version": "12.4.0", "lessThan": "12.4.12", "versionType": "semver"}, {"status": "affected", "version": "13.0.0", "lessThan": "13.0.10", "versionType": "semver"}, {"status": "affected", "version": "13.1.0", "lessThan": "13.1.7", "versionType": "semver"}, {"status": "affected", "version": "13.2.0", "lessThan": "13.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "12.3.0", "versionType": "semver", "lessThanOrEqual": "12.3.11"}, {"status": "affected", "version": "12.4.0", "lessThan": "12.4.12", "versionType": "semver"}, {"status": "affected", "version": "13.0.0", "lessThan": "13.0.10", "versionType": "semver"}, {"status": "affected", "version": "13.1.0", "lessThan": "13.1.7", "versionType": "semver"}, {"status": "affected", "version": "13.2.0", "lessThan": "13.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-30T11:16:43.757", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-13719", "source": "security@grafana.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@grafana.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed."}], "lastModified": "2026-09-30T17:23:08.953", "sourceIdentifier": "security@grafana.com"}