GRAFANA · CVE-2026-111024 · Other
FIX → 13.3.1 +2 ✓ verified
A user with the Viewer or Editor role can get around folder permissions on resources managed by Git Sync through the repository files API. A Viewer can read files in folders they should not access, and an Editor can create, change, move or delete provisioned dashboards and folders there.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted Grafana instances that use Git Sync to provision dashboards and folders from a Git repository. A logged-in Viewer can read files in folders they should not access through the repository files API, and an Editor can create, change, move or delete provisioned dashboards and folders there. Instances without Git Sync repositories are not shown to be affected.
Not affected if git-sync-disabled, no-git-sync
Who cares git-sync, grafana, provisioning, self-hosted
13.1.10 / 13.2.6 / 13.3.1 on its branch (grafana-server --version, or Help menu)A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned dashboards and folders there (incorrect authorization).
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 13.3.1 +2
Upgrade Grafana to 13.3.1, 13.2.6 or 13.1.10 (all released 2026-11-10), depending on your release branch.