CVE-2026-76154NVD

Vulnerability Summary

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

Severity Level

HIGH(7.3)

Published Date

Sep 17, 2026

Last Modified

Sep 18, 2026

Exploitation Status

No confirmed exploitation yet

EPSS Score (30-Day)

0.39%Probability

Root Weakness (CWE)

CWE-79: Cross-site Scripting (XSS) ↗

The software does not neutralize user-controllable input before it is placed in output that is used as a web page.

CVSS v3.1 Base Metrics — Score 7.3 (HIGH)

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredLow

User InteractionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityNone

Affected & Patched Versions

Affected Versions

Grafana Grafana OSS >= 12.3.0
Grafana Grafana OSS >= 12.4.0 and <= 12.4.10
Grafana Grafana OSS >= 13.0.0 and <= 13.0.8
Grafana Grafana OSS >= 13.1.0 and <= 13.1.5
Grafana Grafana OSS >= 13.2.0 and <= 13.2.1
Grafana Grafana Enterprise >= 12.3.0
Grafana Grafana Enterprise >= 12.4.0 and <= 12.4.10
Grafana Grafana Enterprise >= 13.0.0 and <= 13.0.8
Grafana Grafana Enterprise >= 13.1.0 and <= 13.1.5
Grafana Grafana Enterprise >= 13.2.0 and <= 13.2.1

Patched Versions

Grafana Grafana OSS 12.4.10
Grafana Grafana OSS 13.0.8
Grafana Grafana OSS 13.1.5
Grafana Grafana OSS 13.2.1
Grafana Grafana Enterprise 12.4.10
Grafana Grafana Enterprise 13.0.8
Grafana Grafana Enterprise 13.1.5
Grafana Grafana Enterprise 13.2.1

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.