{"id":"CVE-2026-13721","kind":"vulnerability","aliases":["CVE-2026-13721"],"related":[],"title":"Grafana: folder editors can change Git Sync resources they only view","description":"A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders where they only had view access, through the provisioning files API (incorrect authorization).","summary":"A user with edit access to one folder could modify, move or delete resources provisioned by Git Sync in folders where they only had view access, via the provisioning files API. The flaw is incorrect authorization, so an attacker gets write actions beyond their granted permissions.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["git-sync","grafana","other","self-hosted"],"not_affected_if":["git-sync-unused"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-11T15:17:22+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","triaged_at":"2026-11-11T15:29:45+00:00","updated_at":"2026-11-11T15:29:45+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T15:29:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Grafana: folder editors can change Git Sync resources they only view","impact":"medium","summary":"A user with edit access to one folder could modify, move or delete resources provisioned by Git Sync in folders where they only had view access, via the provisioning files API. The flaw is incorrect authorization, so an attacker gets write actions beyond their granted permissions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["grafana","self-hosted","git-sync"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated users modify or delete provisioned dashboards beyond their folder access","analyst_note":"Check the NVD entry and Grafana security advisory for affected and fixed versions and whether Git Sync is required.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["git-sync-unused"],"who_is_affected":"Teams running Grafana with the Git Sync provisioning feature and multiple users who hold folder-level edit or view roles. Instances without Git Sync or without per-folder permissions are less likely to be exposed. The sources do not state which Grafana versions are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000682,"input_tokens":4506,"output_tokens":462,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-13721':14A,17A '-2026':13A,16A 'access':30B,51B,76C,96C 'action':67B 'api':56B,101C 'attack':64B 'author':61B,103C 'beyond':68B 'chang':5A 'could':34B,80C 'cve':12A,15A 'delet':38B,84C 'edit':29B,75C 'editor':3A 'file':55B,100C 'flaw':58B 'folder':2A,33B,45B,79C,90C 'get':65B 'git':6A,19B,42B,85C 'git-sync':18B 'grafana':1A,21B 'grant':70B 'host':25B 'incorrect':60B,102C 'modifi':35B,81C 'move':36B,82C 'one':32B,78C 'permiss':71B 'provis':40B,54B,87C,99C 'resourc':8A,39B,88C 'self':24B 'self-host':23B 'sync':7A,20B,43B,86C 'user':27B,73C 'via':52B 'view':11A,50B,95C 'write':66B","nicknames":[],"mitigations":[],"who_affected":"Teams running Grafana with the Git Sync provisioning feature and multiple users who hold folder-level edit or view roles. Instances without Git Sync or without per-folder permissions are less likely to be exposed. The sources do not state which Grafana versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gitsync","grafana","medium","other","selfhosted"],"campaign_type":null,"search_a":"'-13721':14A,17A '-2026':13A,16A 'chang':5A 'cve':12A,15A 'editor':3A 'folder':2A 'git':6A 'grafana':1A 'resourc':8A 'sync':7A 'view':11A","search_b":"'access':30B,51B 'action':67B 'api':56B 'attack':64B 'author':61B 'beyond':68B 'could':34B 'delet':38B 'edit':29B 'file':55B 'flaw':58B 'folder':33B,45B 'get':65B 'git':19B,42B 'git-sync':18B 'grafana':21B 'grant':70B 'host':25B 'incorrect':60B 'modifi':35B 'move':36B 'one':32B 'permiss':71B 'provis':40B,54B 'resourc':39B 'self':24B 'self-host':23B 'sync':20B,43B 'user':27B 'via':52B 'view':50B 'write':66B","search_c":"'access':76C,96C 'api':101C 'author':103C 'could':80C 'delet':84C 'edit':75C 'file':100C 'folder':79C,90C 'git':85C 'incorrect':102C 'modifi':81C 'move':82C 'one':78C 'provis':87C,99C 'resourc':88C 'sync':86C 'user':73C 'view':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T15:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-13721","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13721","severity":null,"published_at":"2026-11-11T15:17:22+00:00","modified_at":"2026-11-11T15:17:22+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","fetched_at":"2026-11-11T15:27:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}