{"id":"CVE-2026-111024","kind":"vulnerability","aliases":["CVE-2026-111024"],"related":[],"title":"Grafana: Viewer and Editor roles bypass folder permissions on Git Sync","description":"A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned dashboards and folders there (incorrect authorization).","summary":"A user with the Viewer or Editor role can get around folder permissions on resources managed by Git Sync through the repository files API. A Viewer can read files in folders they should not access, and an Editor can create, change, move or delete provisioned dashboards and folders there.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"grafana","fixed":["13.1.10","13.2.6","13.3.1"],"affected":"unknown lower bound, < 13.1.10 / < 13.2.6 / < 13.3.1 on the respective branches","ecosystem":"vendor"}],"ecosystems":[],"tags":["git-sync","grafana","other","provisioning","self-hosted"],"not_affected_if":["git-sync-disabled","no-git-sync"],"how_to_check":"Check whether the instance uses Git Sync (Administration > Provisioning shows configured repositories; Git Sync repositories exist) and whether the Grafana version is below 13.1.10 / 13.2.6 / 13.3.1 on its branch (grafana-server --version, or Help menu). Lowest affected version is not stated by Grafana yet. If no Git Sync repository is configured you can skip this.","fix":"Upgrade Grafana to 13.3.1, 13.2.6 or 13.1.10 (all released 2026-11-10), depending on your release branch.","status":"open","published_at":"2026-11-11T15:17:14+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","triaged_at":"2026-11-11T15:29:40+00:00","updated_at":"2026-11-11T15:31:18+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T15:29:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Grafana: Viewer and Editor roles bypass folder permissions on Git Sync","impact":"medium","summary":"A user with the Viewer or Editor role can get around folder permissions on resources managed by Git Sync through the repository files API. A Viewer can read files in folders they should not access, and an Editor can create, change, move or delete provisioned dashboards and folders there.","audience":"businesses","category":"other","nicknames":[],"who_cares":["grafana","git-sync","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Viewers read restricted files; Editors modify provisioned dashboards they should not reach","analyst_note":"Find affected and fixed Grafana versions and the Git Sync setting in the NVD or Grafana advisory for CVE-2026-111024; the sources given name no product ranges.","how_to_check":"unknown","plain_action":"","product_name":"Grafana","needs_analyst":true,"not_affected_if":["git-sync-disabled"],"who_is_affected":"Teams running Grafana with Git Sync enabled to manage dashboards and folders from a Git repository, where folder permissions are used to separate access between users. The sources do not say which Grafana versions are affected or whether the repository files API is enabled by default. Installations without Git Sync are not described as affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000718,"input_tokens":4541,"output_tokens":527,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed Grafana versions and the Git Sync setting in the NVD or Grafana advisory for CVE-2026-111024; the sources given name no product ranges.","search":"'-111024':14A,17A '-2026':13A,16A 'access':62B,108C 'api':51B,97C 'around':38B 'author':124C 'bypass':6A,85C 'chang':68B 'could':84C,100C,106C,112C 'creat':67B,113C 'cve':12A,15A 'dashboard':73B,119C 'delet':71B,117C 'editor':4A,34B,65B,82C,111C 'file':50B,56B,96C,102C 'folder':7A,39B,58B,75B,86C,104C,121C 'get':37B 'git':10A,20B,45B,89C 'git-sync':19B 'grafana':1A,18A,22B 'host':27B 'incorrect':123C 'manag':43B,91C 'modifi':114C 'move':69B,115C 'permiss':8A,40B,87C 'provis':24B,72B,118C 'read':55B,101C 'repositori':49B,95C 'resourc':42B,92C 'role':5A,35B,83C 'self':26B 'self-host':25B 'sync':11A,21B,46B,90C 'user':29B,77C 'viewer':2A,32B,53B,80C,99C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Grafana instances that use Git Sync to provision dashboards and folders from a Git repository. A logged-in Viewer can read files in folders they should not access through the repository files API, and an Editor can create, change, move or delete provisioned dashboards and folders there. Instances without Git Sync repositories are not shown to be affected.","tier":"B","verified":{"fix":{"at":"2026-11-11T15:31:18Z","by":"analyst","doc":"https://github.com/grafana/grafana/releases/tag/v13.1.10","run_id":3563}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["grafana"],"ptokens":["grafana"],"labels":["gitsync","grafana","high","other","provisioning","selfhosted"],"campaign_type":null,"search_a":"'-111024':14A,17A '-2026':13A,16A 'bypass':6A 'cve':12A,15A 'editor':4A 'folder':7A 'git':10A 'grafana':1A,18A 'permiss':8A 'role':5A 'sync':11A 'viewer':2A","search_b":"'access':62B 'api':51B 'around':38B 'chang':68B 'creat':67B 'dashboard':73B 'delet':71B 'editor':34B,65B 'file':50B,56B 'folder':39B,58B,75B 'get':37B 'git':20B,45B 'git-sync':19B 'grafana':22B 'host':27B 'manag':43B 'move':69B 'permiss':40B 'provis':24B,72B 'read':55B 'repositori':49B 'resourc':42B 'role':35B 'self':26B 'self-host':25B 'sync':21B,46B 'user':29B 'viewer':32B,53B","search_c":"'access':108C 'api':97C 'author':124C 'bypass':85C 'could':84C,100C,106C,112C 'creat':113C 'dashboard':119C 'delet':117C 'editor':82C,111C 'file':96C,102C 'folder':86C,104C,121C 'git':89C 'incorrect':123C 'manag':91C 'modifi':114C 'move':115C 'permiss':87C 'provis':118C 'read':101C 'repositori':95C 'resourc':92C 'role':83C 'sync':90C 'user':77C 'viewer':80C,99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T15:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111024","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111024","severity":null,"published_at":"2026-11-11T15:17:14+00:00","modified_at":"2026-11-11T15:17:14+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","fetched_at":"2026-11-11T15:27:49+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111024:3563","url":"https://github.com/grafana/grafana/releases/tag/v13.3.1","severity":null,"published_at":"2026-11-11T15:31:18+00:00","modified_at":"2026-11-11T15:31:18+00:00","first_seen_at":"2026-11-11T15:31:18+00:00","fetched_at":"2026-11-11T15:31:18+00:00","note":"Grafana's 13.3.1/13.2.6/13.1.10 release notes list 'Security: Fix CVE-2026-111024'. The Grafana advisory page and NVD text are not published yet, so affected range lower bound, CVSS and exact trigger are unconfirmed; the description comes from triage. Only fix is marked verified. Revisit when the advisory appears.","cites":["https://github.com/grafana/grafana/releases/tag/v13.3.1","https://github.com/grafana/grafana/releases/tag/v13.2.6","https://github.com/grafana/grafana/releases/tag/v13.1.10"]}],"documents":[{"id":126643,"url":"https://github.com/grafana/grafana/releases/tag/v13.3.1","title":"Grafana 13.3.1 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":126644,"url":"https://github.com/grafana/grafana/releases/tag/v13.2.6","title":"Grafana 13.2.6 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":126645,"url":"https://github.com/grafana/grafana/releases/tag/v13.1.10","title":"Grafana 13.1.10 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}