UpHeron
All vulnerabilities

Servers and applications

CVE-2026-13721

Folder authorization bypass in the Git Sync provisioning files API

Severity
Medium 6.5
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Weakness
Incorrect authorization (CWE-863)Authorization bypass through a user-controlled key (IDOR) (CWE-639)CWE-696
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Change data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Sources
CVE Program

Description

A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders where they only had view access, through the provisioning files API (incorrect authorization).

From the CVE Program.

Affected software

SoftwareAffected versions
GrafanaServers and applications · cna:grafana|grafana enterprise
  • From 13.0.0 up to 13.0.12
  • From 13.1.0 up to 13.1.9
  • From 13.2.0 up to 13.2.5
  • From 13.3.0 up to 13.3.0

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-13721