CVE-2026-21721
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* ac
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
HIGH · CVSS 8.1
EPSS 0.00019
Schedule remediation
- CVSS base score ≥ 7.0
Sigma rules0
YARA rules0