{"id":"CVE-2026-21727","published":"2026-04-15T18:57:25Z","modified":"2026-08-27T17:22:44Z","title":"Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record","vendor":"Grafana","product":"Grafana Correlations","tier":"tail","description":{"text":"A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.\n\nThanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.","provenance":"source","from":"CVE.org"},"cvss":{"score":3.3,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00204,"percentile":0.10358,"provenance":"source"},"cwes":[{"id":"CWE-732","name":"Incorrect Permission Assignment for Critical Resource"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-21727","tags":["vendor-advisory"]}],"priority":{"score":4.4,"factors":[{"name":"EPSS percentile","points":2.07},{"name":"CVSS severity","points":2.31}]},"vendorSlug":"grafana","affectedVersions":[{"vendor":"Grafana","product":"Grafana Correlations","versions":[">= 10.2.0, < 12.4.0"]}],"affected":[{"ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":["<1.9.2-0.20260127141016-e702db6096e0","all versions"],"patched":["1.9.2-0.20260127141016-e702db6096e0"],"from":["GHSA-p5x9-j974-rpfp","GO-2026-6664"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-23011","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2025-4123","published":"2025-05-22","fixed":"0.0.0-20250521183405-c7a690348df7","kev":false},{"cve":"CVE-2025-3415","published":"2025-07-17","fixed":"1.9.2-0.20250514160932-04111e9f2afd","kev":false},{"cve":"CVE-2025-6023","published":"2025-07-18","fixed":"1.9.2-0.20250521205822-0ba0b99665a9","kev":false},{"cve":"CVE-2026-21727","published":"2026-04-15","fixed":"1.9.2-0.20260127141016-e702db6096e0","kev":false},{"cve":"CVE-2026-21724","published":"2026-03-26","fixed":"1.9.2-0.20260323180334-daffe750de85","kev":false},{"cve":"CVE-2026-33380","published":"2026-05-13","fixed":"1.9.2-0.20260513165311-fb7336fc36c1","kev":false},{"cve":"CVE-2026-33381","published":"2026-05-13","fixed":"1.9.2-0.20260513165311-fb7336fc36c1","kev":false},{"cve":"CVE-2025-41115","published":"2025-11-21","fixed":"12.2.2","kev":false,"link":{"from":"CVE-2025-41115","to":"CVE-2026-21727","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"1.9.2-0.20251106142618-ca5d89812015","toFixed":"1.9.2-0.20260127141016-e702db6096e0","daysApart":145}]}}],"package":"Go:github.com/grafana/grafana"}}