CVE-2026-13719 - Vulnerability Details - OpenCVE

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://grafana.com/security/security-advisories/cve-2026-13719

History

Wed, 30 Sep 2026 11:15:00 +0000

Type	Values Removed	Values Added
Description		An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.
Title		Alert rules in restricted folders disclosed via the alert rules list API
Weaknesses		CWE-200 CWE-863
References		https://grafana.com/security/security-advisories/cve-2026-13719
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: GRAFANA

Published: 2026-09-30T11:06:38.172Z

Updated: 2026-09-30T14:29:13.891Z

Reserved: 2026-06-29T14:10:37.534Z

Link: CVE-2026-13719

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-30T11:16:43.757

Modified: 2026-09-30T11:16:43.757

Link: CVE-2026-13719

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-30T13:00:16Z

Weaknesses

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13719", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-06-29T14:10:37.534Z", "datePublished": "2026-09-30T11:06:38.172Z", "dateUpdated": "2026-09-30T14:29:13.891Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThan": "12.4.12", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.10", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.7", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.3", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThan": "12.4.12", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.10", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.7", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.3", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "mon3m"}], "datePublic": "2026-09-29T07:44:02.000Z", "descriptions": [{"lang": "en", "value": "An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed."}], "metrics": [{"cvssV3_1": {"baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-200", "description": "CWE-200", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-09-30T13:05:14.113Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-13719"}], "source": {"discovery": "BUG_BOUNTY"}, "title": "Alert rules in restricted folders disclosed via the alert rules list API"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-30T14:29:01.284869Z", "id": "CVE-2026-13719", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T14:29:13.891Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThan": "12.4.12", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.10", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.7", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.3", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThan": "12.4.12", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.10", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.7", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.3", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed."}], "id": "CVE-2026-13719", "lastModified": "2026-09-30T11:16:43.757", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@grafana.com", "type": "Secondary"}]}, "published": "2026-09-30T11:16:43.757", "references": [{"source": "security@grafana.com", "url": "https://grafana.com/security/security-advisories/cve-2026-13719"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-863"}], "source": "security@grafana.com", "type": "Secondary"}]}