CVE-2026-19197

A flaw was found in Grafana. This broken access control vulnerability allows a user with organization administrator permissions to delete dashboard snapshots belonging to other organizations on the same Grafana instance. Furthermore, the flaw enables the recovery of a snapshot's secret delete key using only its public share key, leading to unauthorized data manipulation and potential information disclosure.

An access control vulnerability was found in Grafana's dashboard snapshot management API. An authenticated user with organization administrator privileges can exploit broken authorization logic using a public snapshot share key to recover the secret deletion key. This allows the attacker to delete dashboard snapshots and manipulate snapshot records across organization boundaries on multi-tenant Grafana instances, compromising cross-tenant data isolation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable dashboard snapshot functionality by setting enabled = false under the [snapshots] section in /etc/grafana/grafana.ini. Alternatively, isolate sensitive tenants across dedicated Grafana instances rather than relying on shared multi-tenant deployments.