CVE-2026-76154

Summary

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

Affected Software

VendorProductVersion RangeStatus
GrafanaGrafana OSS12.3.0affected
GrafanaGrafana OSS12.4.0 <= 12.4.10affected
GrafanaGrafana OSS13.0.0 <= 13.0.8affected
GrafanaGrafana OSS13.1.0 <= 13.1.5affected
GrafanaGrafana OSS13.2.0 <= 13.2.1affected
GrafanaGrafana Enterprise12.3.0affected
GrafanaGrafana Enterprise12.4.0 <= 12.4.10affected
GrafanaGrafana Enterprise13.0.0 <= 13.0.8affected
GrafanaGrafana Enterprise13.1.0 <= 13.1.5affected
GrafanaGrafana Enterprise13.2.0 <= 13.2.1affected

Weaknesses

  • CWE-79: CWE-79

References