CVE-2026-33387
A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter.
Published Sep 8, 2026 · updated Oct 15, 2026
A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a malicious dashboard. When the victim views or imports the dashboard, the payload executes in their browser context, allowing the attacker to modify application data or disrupt application availability.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Sep 8, 2026 · NIST NVD
Detected
A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a malicious dashboard. When the victim views or imports the dashboard, the payload executes in their browser
Oct 15, 2026 · NIST NVD
Updated
A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a malicious dashboard. When the victim views or imports the dashboard, the payload executes in their browser
Sources
- CVE.orgVulnerability recordCVE-2026-33387
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-33387
30-day exploitation probability 0.3%
first.org - NIST NVDVulnerability recordCVE-2026-33387
A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered int
nvd.nist.gov