CVE-2026-81842

A flaw was found in Grafana. The application fails to verify creation permissions on destination folders during panel update operations. An authenticated user with edit permissions in one folder can exploit this vulnerability through the library elements API to move a library panel into a folder where they only possess view permissions. This allows an unauthorized user to bypass access controls and place content into restricted folders.

This vulnerability is rated as having a Moderate impact because exploitation requires an authenticated account with edit rights to at least one folder, and the blast radius is confined to relocating library panels into read-only folders. An attacker cannot read restricted data from the destination location or alter preexisting dashboards and panels. Therefore, the issue does not allow confidentiality loss or arbitrary administrative compromise within Grafana.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.