Alert rules in restricted folders disclosed via the alert rules list API
An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.
CVE-2026-13719
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-13719
Grafana Enterprise
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Grafana OSS
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Grafana",
"product": "Grafana Enterprise",
"versions": [
{
"status": "affected",
"version": "12.3.0",
"versionType": "semver",
"lessThanOrEqual": "12.3.11"
},
{
"status": "affected",
"version": "12.4.0",
"lessThan": "12.4.12",
"versionType": "semver"
},
{
"status": "affected",
"version": "13.0.0",
"lessThan": "13.0.10",
"versionType": "semver"
},
{
"status": "affected",
"version": "13.1.0",
"lessThan": "13.1.7",
"versionType": "semver"
},
{
"status": "affected",
"version": "13.2.0",
"lessThan": "13.2.3",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Grafana",
"product": "Grafana OSS",
"versions": [
{
"status": "affected",
"version": "12.3.0",
"versionType": "semver",
"lessThanOrEqual": "12.3.11"
},
{
"status": "affected",
"version": "12.4.0",
"lessThan": "12.4.12",
"versionType": "semver"
},
{
"status": "affected",
"version": "13.0.0",
"lessThan": "13.0.10",
"versionType": "semver"
},
{
"status": "affected",
"version": "13.1.0",
"lessThan": "13.1.7",
"versionType": "semver"
},
{
"status": "affected",
"version": "13.2.0",
"lessThan": "13.2.3",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-13719
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #4409 · Revision 1
- Added to Heist Feed
- Publisher date