CVE-2026-13719 describes an information disclosure vulnerability in Grafana where an authenticated user can enumerate alert rules in folders they lack read access to by using the alert rules API list endpoint. When the user's readable folder set is empty, the folder filtering is ignored, resulting in exposure of all alert rules within the organization. This vulnerability was introduced in Grafana 13.1.0. The data exposed is limited to rule configuration details and does not include sensitive credentials.

The vulnerability allows an authenticated user to gain unauthorized visibility into alert rule configurations across the organization, potentially revealing operational details about monitoring setups. However, it does not expose data source credentials or allow modification of alert rules. The CVSS score of 4.3 reflects a medium severity information disclosure risk with network attack vector and low complexity.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should review user permissions and monitor API usage for suspicious activity related to alert rule enumeration.