[ CVE-2026-13719 · Published 30 Sep 2026 ]

Vulnerability in Grafana Enterprise

CVSS 4.3 EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

BSI CERT-Bund30 Sep 2026WID-SEC-2026-3675

Grafana: Multiple vulnerabilities Translated from German
CVE-2026-13720CVE-2026-13719

[ References ]References

grafana.com/security/security-advisories/cve-2026-13719

[ Facts ]Key facts

CVE: CVE-2026-13719
EUVD: EUVD-2026-89774
Published: 30 Sep 2026, 11:16 UTC
Updated: 30 Sep 2026, 17:23 UTC
NVD status: Awaiting Analysis
CVSS 3.1: 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Scored by security@grafana.com
EPSS: 0.30% chance of exploitation in 30 days · higher than 22% of CVEs
CISA SSVC: Exploitation: none · Automatable: no · Impact: partial
Weakness: CWE-200 CWE-863

[ Affected ]Affected products

Grafana Grafana Enterprise12.3.0 – ≤ 12.3.11, 12.4.0 – < 12.4.12, 13.0.0 – < 13.0.10, 13.1.0 – < 13.1.7, 13.2.0 – < 13.2.3
Grafana Grafana OSS12.3.0 – ≤ 12.3.11, 12.4.0 – < 12.4.12, 13.0.0 – < 13.0.10, 13.1.0 – < 13.1.7, 13.2.0 – < 13.2.3

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

Grafana: Multiple vulnerabilities Translated from German

[ References ]References