BIT-grafana-2026-33377

vendorUSosv

Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin

view advisory published 2026-05-15Licence: per source

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-33377US	—	0.23% (13th)	—	2026-05-13
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

references

External citations — patches, advisories, analysis.

https://grafana.com/security/security-advisories/cve-2026-33377ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-33377WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan