CVE-2026-11817

CVE-2026-11817 exposes a permission topology disclosure in Grafana's multi-org deployments through the /api/access-control/users/permissions/search endpoint. The vulnerability allows any org administrator to retrieve permission mappings across all organizations, not just their own. While the CVE characterization emphasizes that dashboard contents, queries, and credentials are not exposed, the permission graph itself — which users hold which access levels on which resources across the entire deployment — is precisely the reconnaissance data that enables targeted privilege escalation. This isn't a limited disclosure; it's a force multiplier that retroactively upgrades the severity of every other access control flaw in the environment. The root cause is architectural, not incidental. Grafana's access control layer assumes org filtering happens at the data layer, but aggregation endpoints that synthesize permission data across users and resources operate outside that assumption. Search endpoints are built specifically to retrieve data that wouldn't normally flow together, which inherently conflicts with tenant boundary enforcement. The multi-org configuration path represents a minority deployment that likely received minimal testing pressure — the dominant single-org use case dominated code review and dogfooding, leaving org-boundary gaps in aggregation paths unexercised. The CVSS 5.3 score fundamentally mismeasures this vulnerability. It assesses the disclosure event in isolation, not the attack surface it unlocks. In multi-org deployments — which typically serve as federation or shared infrastructure layers — permission topology disclosure collapses the isolation model those deployments exist to provide. Once an attacker maps who has access to what across organizations, every downstream vulnerability becomes targetable with precision rather than sprayed across the user base. The disclosure compounds through subsequent findings. For defenders in multi-org environments: audit other aggregation endpoints in the access control subsystem for similar org-context gaps. The fix scope matters — if Grafana shipped a surgical patch rather than addressing the architectural assumption that data-layer filtering handles tenant isolation, similar boundary failures likely exist elsewhere. Prioritize patching this endpoint regardless of its medium severity rating; the exposure window between public disclosure and patch deployment is where targeted exploitation occurs, and the permission data it exposes ages every other vulnerability in the stack.

Reviewed through automated stages and approved by a human before publication.