---
id: "CVE-2026-111000"
page: "https://infrastack.ai/live/CVE-2026-111000"
kind: "vulnerability"
aliases: ["CVE-2026-111000"]
title: "Grafana: Editors can gain Admin on a folder by moving it under a folder they administer"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "grafana", "fixed": ["12.4.15"], "affected": "unknown; 12.4.x before 12.4.15 likely", "ecosystem": "vendor"}]
ecosystems: []
tags: ["editor-role", "folders", "grafana", "other", "rbac", "self-hosted"]
not_affected_if: ["no-editor-users", "no-nested-folder-permissions", "unknown"]
published_at: "2026-11-11T15:17:14+00:00"
first_seen_at: "2026-11-11T15:27:49+00:00"
updated_at: "2026-11-11T15:31:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111000", "first_seen_at": "2026-11-11T15:27:49+00:00"}, {"source": "analyst", "url": "https://github.com/grafana/grafana/releases/tag/v12.4.15", "first_seen_at": "2026-11-11T15:31:13+00:00", "cites": ["https://github.com/grafana/grafana/releases/tag/v12.4.15", "https://grafana.com/security/security-advisories/"]}]
exploit_sources: []
---

# Grafana: Editors can gain Admin on a folder by moving it under a folder they administer

Link for people: https://infrastack.ai/live/CVE-2026-111000 (this .md is for agents)

A user with the Editor role who can edit a folder can move it through the folders resource API under a folder they administer. That gives them Admin rights over the moved folder and its contents, including control of its permissions.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:grafana affected unknown; 12.4.x before 12.4.15 likely fixed 12.4.15

## How to check

Run grafana-server -v (or check Help > About in the UI). If you are on 12.4.x below 12.4.15, you are likely exposed. Other branches: unknown until Grafana publishes the advisory. Also check whether Editors have Edit on folders and Admin on others.

## Fix

Grafana 12.4.15 (release notes list Fix CVE-2026-111000). Fixed versions on other branches (e.g. 13.x) not confirmed; Grafana has not yet published an advisory.

## Timeline

- 2026-11-11T15:27:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111000
- 2026-11-11T15:31:13+00:00 analyst https://github.com/grafana/grafana/releases/tag/v12.4.15 — NVD page not readable; Grafana 12.4.15 release notes (10 Nov 2026) list the CVE as fixed. No Grafana advisory page yet, so affected range and other branch fixes unknown; nothing marked verified. CVSS 7.1 by security@grafana.com.

## Documents

- [fix] Grafana 12.4.15 release notes https://github.com/grafana/grafana/releases/tag/v12.4.15
- [mentions] Grafana security advisories index (no entry for this CVE yet) https://grafana.com/security/security-advisories/

## From the sources

A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move (improper privilege management).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_