UpHeron
All vulnerabilities

Servers and applications

CVE-2026-111024

Folder permission bypass in the Git Sync repository files API

Severity
High 7.1
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Weakness
Incorrect authorization (CWE-863)CWE-636Information exposure (CWE-200)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read some data · Change data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Sources
CVE Program

Description

A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned dashboards and folders there (incorrect authorization).

From the CVE Program.

Affected software

SoftwareAffected versions
GrafanaServers and applications · cna:grafana|grafana enterprise
  • From 13.0.2 up to 13.0.12
  • From 13.1.0 up to 13.1.9
  • From 13.2.0 up to 13.2.5
  • From 13.3.0 up to 13.3.0

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-111024