CVE-2026-14242 · Vendor
NO FIX YET
A user with the Editor role could create a provisioning job through the jobs resource API that skipped folder permission checks. That let them delete, move, push or pull Git Sync managed resources in folders where they only had view access.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Grafana with Git Sync (provisioning) enabled and folder-level permissions that give some users view-only access while others are Editors. Instances that do not use Git Sync, or where all Editors can already modify every folder, are unlikely to gain anything from this flaw. The sources do not name affected versions.
Not affected if git-sync-disabled, no-folder-permissions
Who cares git-sync, grafana, self-hosted
Unknown from the sources.
No fix yet, per the sources.
A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorization).
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.