CVE-2026-21721 is a Grafana vulnerability where the dashboard permissions API fails to verify the target dashboard scope and only checks the dashboards.permissions:* action. Consequently, a user with permission management rights on one dashboard can escalate privileges by reading and modifying permissions on other dashboards within the organization. This represents an internal cross-dashboard privilege escalation. The vulnerability is tracked under CWE-639 (Authorization Bypass Through User-Controlled Key). Red Hat has released security advisories and updates for affected versions of Grafana to remediate this issue.

An attacker with permission management rights on a single dashboard can bypass scope restrictions and manipulate permissions on other dashboards. This leads to unauthorized access and modification of dashboard permissions across the organization, potentially compromising data confidentiality and integrity within Grafana dashboards. The impact is limited to internal users with existing permission management rights but represents a significant privilege escalation risk.

Red Hat has released official security updates that fix this vulnerability. Users should apply the provided patches as detailed in the Red Hat advisories (RHSA-2026:2914 and RHSA-2026:2920) to remediate the issue. The advisories include updated Grafana packages that correct the permissions scope verification. No additional mitigation steps are required beyond applying these official fixes.