CVE-2026-19197: CWE-862 in Grafana Grafana OSS

This vulnerability (CWE-862) in Grafana OSS allows an organization administrator to perform unauthorized actions across organizational boundaries within the same Grafana instance. Specifically, the attacker can delete dashboard snapshots from other organizations and recover secret delete keys from public share keys, violating intended access controls. The CVSS 3.1 base score is 6.3, reflecting a network attack vector with low attack complexity, requiring privileges but no user interaction, and impacting confidentiality, integrity, and availability at a low to medium level.

An attacker with organization administrator privileges can delete dashboard snapshots of other organizations and obtain secret delete keys from public share keys. This leads to unauthorized deletion of data and potential compromise of snapshot security, affecting confidentiality, integrity, and availability of dashboard snapshots across organizations within the same Grafana instance.

No official patch or remediation level has been published yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit organization administrator privileges to trusted users only and monitor for suspicious activity related to dashboard snapshot management.