---
id: "CVE-2026-13721"
page: "https://infrastack.ai/live/CVE-2026-13721"
kind: "vulnerability"
aliases: ["CVE-2026-13721"]
title: "Grafana: folder editors can change Git Sync resources they only view"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["git-sync", "grafana", "other", "self-hosted"]
not_affected_if: ["git-sync-unused"]
published_at: "2026-11-11T15:17:22+00:00"
first_seen_at: "2026-11-11T15:27:49+00:00"
updated_at: "2026-11-11T15:29:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13721", "first_seen_at": "2026-11-11T15:27:49+00:00"}]
exploit_sources: []
---

# Grafana: folder editors can change Git Sync resources they only view

Link for people: https://infrastack.ai/live/CVE-2026-13721 (this .md is for agents)

A user with edit access to one folder could modify, move or delete resources provisioned by Git Sync in folders where they only had view access, via the provisioning files API. The flaw is incorrect authorization, so an attacker gets write actions beyond their granted permissions.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-11T15:27:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-13721

## From the sources

A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders where they only had view access, through the provisioning files API (incorrect authorization).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_