CVE-2026-13719
Last modified
CVE-2026-13719 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned.
Description
An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana Enterprise | >= 12.3.0, <= 12.3.11; >= 12.4.0, < 12.4.12; >= 13.0.0, < 13.0.10; >= 13.1.0, < 13.1.7; >= 13.2.0, < 13.2.3 |
| Grafana | Grafana OSS | >= 12.3.0, <= 12.3.11; >= 12.4.0, < 12.4.12; >= 13.0.0, < 13.0.10; >= 13.1.0, < 13.1.7; >= 13.2.0, < 13.2.3 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-13719?
How severe is CVE-2026-13719?
How do I fix CVE-2026-13719?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-13712The Divi WordPress theme before 5.9.0 does not properly esca…5.4
- CVE-2026-13713YAML::Syck versions before 1.47 for Perl allow a use-after-f…6.2
- CVE-2026-13714The Realtyna Organic IDX plugin + WPL Real Estate WordPress …9.8
- CVE-2026-13716Path traversal in server import and admin file upload in Cra…9.1
- CVE-2026-13717A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Ga…8.8
- CVE-2026-13718The Tabs Responsive WordPress plugin through 2.5 does not s…6.8
- CVE-2026-1372The Tutor LMS Elementor Addons plugin for WordPress is vulne…4.3
- CVE-2026-13720An Editor can set file-provisioning metadata (the grafana.ap…5.4
- CVE-2026-13722WatchGuard Fireware OS contains a firmware validation bypass…7.2
- CVE-2026-13723A vulnerability in the `zipx.Unzip` extraction routine of De…6.5
- CVE-2026-13724Client-Side Enforcement of Server-Side Security vulnerabilit…4.3
- CVE-2026-13725The Dynamic Pricing With Discount Rules for WooCommerce Word…7.1
Are you affected by CVE-2026-13719?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST