GRAFANA · CVE-2026-111000 · Other
FIX → 12.4.15
A user with the Editor role who can edit a folder can move it through the folders resource API under a folder they administer. That gives them Admin rights over the moved folder and its contents, including control of its permissions.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Grafana instances where users hold the Editor role and can edit a folder, and also hold Admin on another folder, are the ones to look at. Through the folders resource API such an Editor can move the folder under the one they administer and gain Admin over it and its contents, including its permissions. The legacy folder move API refuses the same move. Instances with no Editor users, or no folder-level Admin grants, can likely skip it.
Not affected if no-editor-users, no-nested-folder-permissions, unknown
Who cares editor-role, folders, grafana, rbac, self-hosted
12.4.15, you are likely exposedUpgrade to 12.4.15
12.4.15 (release notes list Fix CVE-2026-111000)A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move (improper privilege management).
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.