CVE-2026-21721 — The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard — CVE Database · The Intelligence Room