Cross-Tenant Legacy Correlation Disclosure and Deletion

Low
Advisory ID:CVE-2026-21727
Published:2026-01-29
Product:Grafana
CVSS Score:3.3
CVSS Vector:CVSS:3.3/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Fixed Versions:
>=12.3.3
>=12.2.4 <12.3.0
>=12.1.6 <12.2.0
>=12.0.9 <12.1.0
>=11.6.11 <12.0.0

Summary

A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization.

Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.