Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2026-33377: Adobe Analytics: Dashboard Privilege Escalation via Editor Role
CVE-2026-33377 · published 5 months ago
Summary
Adobe Analytics allows an editor to gain admin access to a dashboard they don't own. This occurs when the editor has write access to the dashboard. To fix this, ensure that users only have the necessary permissions for the tasks they need to perform.
What to do
- Update grafana to version 13.0.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Bitnami | – | grafana |
>= 13.0.0, < 13.0.1 Fix: upgrade to 13.0.1
|
| – | grafana | grafana |
>= 8.5.0, < 11.6.14 >= 12.2.0, < 12.2.8 >= 12.3.0, < 12.3.6 >= 12.4.0, < 12.4.3 11.6.14 12.2.8 12.3.6 12.4.3 13.0.0 13.0.1 cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* |
| – | grafana | grafana oss | <= 11.6.14 |
Original advisory text
Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
References
- https://grafana.com/security/security-advisories/cve-2026-33377 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33377 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33377... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-284Improper Access Control
CWE-287Improper Authentication
Timeline
Published13 May 2026
Updated4 Nov 2026
First seen13 May 2026
Sources
CVE-2026-33377 · NVD
BIT-grafana-2026-33377 · OSV
CVE-2026-33377 · MITRE
CVE-2026-33377 · OSV
Track software like this
Free during beta