Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 13:01:40 +0000 CVE-2026-21721 — Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation https://cve.radiocsirt.org/vuln/cve-2026-21721 <p><strong>Affected:</strong> grafana/grafana, grafana/grafana-enterprise, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Advanced Cluster Management for Kubernetes 2.11, Red Hat Advanced Cluster Management for Kubernetes 2.12, Red Hat Advanced Cluster Management for Kubernetes 2.13, Red Hat Multicluster Global Hub and 4 more</p> <p>The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.</p> <p><strong>Affected:</strong> grafana/grafana, grafana/grafana-enterprise, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Advanced Cluster Management for Kubernetes 2.11, Red Hat Advanced Cluster Management for Kubernetes 2.12, Red Hat Advanced Cluster Management for Kubernetes 2.13, Red Hat Multicluster Global Hub and 4 more</p> <p>The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.</p> https://cve.radiocsirt.org/vuln/cve-2026-21721