This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0869 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-11817:
    This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization     deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single     organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and     receive permission data belonging to other organizations. The disclosed data is limited to dashboard and     folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which     dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data     are not exposed. This is a limited cross-organization information disclosure affecting multi-org     deployments only.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Grafana Labs installed on the remote host is 11.2.x through 11.6.x prior or equal to 11.6.16, 12.2.x prior or equal to 12.2.10, 12.3.x prior or equal to 12.3.8, 12.4.x prior or equal to 12.4.5, 13.0.x prior or equal to 13.0.3, or 13.1.0. It is, therefore, affected by an information disclosure vulnerability:

  - This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization     deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single     organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive     permission data belonging to other organizations. The disclosed data is limited to dashboard and folder     identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which     dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data     are not exposed. This is a limited cross-organization information disclosure affecting multi-org     deployments only. (CVE-2026-11817)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization     deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single     organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and     receive permission data belonging to other organizations. The disclosed data is limited to dashboard and     folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which     dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data     are not exposed. This is a limited cross-organization information disclosure affecting multi-org     deployments only. (CVE-2026-11817)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
342060	TencentOS Server 4: grafana (TSSA-2026:0869)	Nessus	Tencent Local Security Checks	Local	medium
338327	Grafana Labs 11.2.0 <= 11.6.16 / 12.2.0 <= 12.2.10 / 12.3.0 <= 12.3.8 / 12.4.0 <= 12.4.5 / 13.0.0 <= 13.0.3 / 13.1.0 < 13.1.1 Information Disclosure (CVE-2026-11817)	Nessus	Web Servers	Remote	medium
338103	Linux Distros Unpatched Vulnerability : CVE-2026-11817	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-11817

medium

Tenable Plugins

medium

medium

medium