{"id":"CVE-2026-111000","kind":"vulnerability","aliases":["CVE-2026-111000"],"related":[],"title":"Grafana: Editors can gain Admin on a folder by moving it under a folder they administer","description":"A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move (improper privilege management).","summary":"A user with the Editor role who can edit a folder can move it through the folders resource API under a folder they administer. That gives them Admin rights over the moved folder and its contents, including control of its permissions.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"grafana","fixed":["12.4.15"],"affected":"unknown; 12.4.x before 12.4.15 likely","ecosystem":"vendor"}],"ecosystems":[],"tags":["editor-role","folders","grafana","other","rbac","self-hosted"],"not_affected_if":["no-editor-users","no-nested-folder-permissions","unknown"],"how_to_check":"Run grafana-server -v (or check Help > About in the UI). If you are on 12.4.x below 12.4.15, you are likely exposed. Other branches: unknown until Grafana publishes the advisory. Also check whether Editors have Edit on folders and Admin on others.","fix":"Grafana 12.4.15 (release notes list Fix CVE-2026-111000). Fixed versions on other branches (e.g. 13.x) not confirmed; Grafana has not yet published an advisory.","status":"open","published_at":"2026-11-11T15:17:14+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","triaged_at":"2026-11-11T15:29:43+00:00","updated_at":"2026-11-11T15:31:13+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T15:29:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Grafana-style folder API lets Editors escalate to Admin by moving folders","impact":"high","summary":"A user with the Editor role who can edit a folder can move it through the folders resource API under a folder they administer. That gives them Admin rights over the moved folder and its contents, including control of its permissions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["folders","rbac","editor-role"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Editor gains Admin on folders and can change permissions.","analyst_note":"Identify the affected product and fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111000; the signal lists no products or ranges.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that run a self-hosted or managed instance with folder-based permissions and give users the Editor role are the exposed set, since the flaw lets an Editor gain Admin on folders they move. The sources do not name the product, versions, or whether the legacy folder move API path is affected, so the team should confirm which application and versions this record covers. Instances without folder-level Editor permissions can likely skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4533,"output_tokens":497,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111000; the signal lists no products or ranges.","search":"'-111000':19A,22A '-2026':18A,21A 'admin':5A,61B,102C 'administ':16A,57B,98C 'api':52B,93C,121C 'chang':114C 'content':69B,109C 'control':71B 'cve':17A,20A 'edit':42B,83C 'editor':2A,25B,38B,79C 'editor-rol':24B 'folder':8A,14A,27B,44B,50B,55B,66B,85C,91C,96C,106C,119C 'gain':4A,101C 'give':59B 'grafana':1A,23A,28B 'host':33B 'improp':126C 'includ':70B,110C 'legaci':118C 'manag':128C 'move':10A,46B,65B,87C,105C,120C,125C 'permiss':74B,116C 'privileg':127C 'rbac':30B 'refus':122C 'resourc':51B,92C 'right':62B,112C 'role':26B,39B,80C 'self':32B 'self-host':31B 'user':35B,76C","nicknames":[],"mitigations":[],"who_affected":"Grafana instances where users hold the Editor role and can edit a folder, and also hold Admin on another folder, are the ones to look at. Through the folders resource API such an Editor can move the folder under the one they administer and gain Admin over it and its contents, including its permissions. The legacy folder move API refuses the same move. Instances with no Editor users, or no folder-level Admin grants, can likely skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["grafana"],"ptokens":["grafana"],"labels":["editorrole","folders","grafana","high","other","rbac","selfhosted"],"campaign_type":null,"search_a":"'-111000':19A,22A '-2026':18A,21A 'admin':5A 'administ':16A 'cve':17A,20A 'editor':2A 'folder':8A,14A 'gain':4A 'grafana':1A,23A 'move':10A","search_b":"'admin':61B 'administ':57B 'api':52B 'content':69B 'control':71B 'edit':42B 'editor':25B,38B 'editor-rol':24B 'folder':27B,44B,50B,55B,66B 'give':59B 'grafana':28B 'host':33B 'includ':70B 'move':46B,65B 'permiss':74B 'rbac':30B 'resourc':51B 'right':62B 'role':26B,39B 'self':32B 'self-host':31B 'user':35B","search_c":"'admin':102C 'administ':98C 'api':93C,121C 'chang':114C 'content':109C 'edit':83C 'editor':79C 'folder':85C,91C,96C,106C,119C 'gain':101C 'improp':126C 'includ':110C 'legaci':118C 'manag':128C 'move':87C,105C,120C,125C 'permiss':116C 'privileg':127C 'refus':122C 'resourc':92C 'right':112C 'role':80C 'user':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T15:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111000","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111000","severity":null,"published_at":"2026-11-11T15:17:14+00:00","modified_at":"2026-11-11T15:17:14+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","fetched_at":"2026-11-11T15:27:49+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111000:3564","url":"https://github.com/grafana/grafana/releases/tag/v12.4.15","severity":null,"published_at":"2026-11-11T15:31:13+00:00","modified_at":"2026-11-11T15:31:13+00:00","first_seen_at":"2026-11-11T15:31:13+00:00","fetched_at":"2026-11-11T15:31:13+00:00","note":"NVD page not readable; Grafana 12.4.15 release notes (10 Nov 2026) list the CVE as fixed. No Grafana advisory page yet, so affected range and other branch fixes unknown; nothing marked verified. CVSS 7.1 by security@grafana.com.","cites":["https://github.com/grafana/grafana/releases/tag/v12.4.15","https://grafana.com/security/security-advisories/"]}],"documents":[{"id":126641,"url":"https://github.com/grafana/grafana/releases/tag/v12.4.15","title":"Grafana 12.4.15 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":126642,"url":"https://grafana.com/security/security-advisories/","title":"Grafana security advisories index (no entry for this CVE yet)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}