CVE-2026-21727

LowCVSS 3.3/10Last modified Aug 19, 2026

Description

A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.

Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Apr 15, 2026
Last modified: Aug 19, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-217287.5Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deploy CVE-2026-217297.5Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deploym CVE-2026-21739.8A vulnerability was identified in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the f CVE-2026-217306.1Verba is affected by a Stored Cross-Site Scripting (XSS) vulnerability within its login logging mechanism. When an unauthenticated remote at CVE-2026-217329.6A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash i CVE-2026-217337.3Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user CVE-2026-217347.7A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash i CVE-2026-217364.4Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user CVE-2026-21749.8A security flaw has been discovered in code-projects Contact Management System 1.0. This affects an unknown part of the component CRUD Endpo CVE-2026-217414.8An URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, For CVE-2026-217426.5A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through CVE-2026-217437.2A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenti