{"id":"CVE-2026-14242","kind":"vulnerability","aliases":["CVE-2026-14242"],"related":[],"title":"Grafana: Editor role can change Git Sync resources in view-only folders","description":"A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorization).","summary":"A user with the Editor role could create a provisioning job through the jobs resource API that skipped folder permission checks. That let them delete, move, push or pull Git Sync managed resources in folders where they only had view access.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["git-sync","grafana","self-hosted","vendor"],"not_affected_if":["git-sync-disabled","no-folder-permissions"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-11T15:17:22+00:00","first_seen_at":"2026-11-11T15:27:50+00:00","triaged_at":"2026-11-11T15:29:44+00:00","updated_at":"2026-11-11T15:29:44+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-11T15:29:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Grafana: Editor role can change Git Sync resources in view-only folders","impact":"medium","summary":"A user with the Editor role could create a provisioning job through the jobs resource API that skipped folder permission checks. That let them delete, move, push or pull Git Sync managed resources in folders where they only had view access.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["grafana","self-hosted","git-sync"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Editor users alter Git Sync resources in folders they can only view","analyst_note":"Find affected and fixed Grafana versions and the Git Sync setting from the NVD entry or Grafana's security advisory for CVE-2026-14242.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["git-sync-disabled","no-folder-permissions"],"who_is_affected":"Teams running Grafana with Git Sync (provisioning) enabled and folder-level permissions that give some users view-only access while others are Editors. Instances that do not use Git Sync, or where all Editors can already modify every folder, are unlikely to gain anything from this flaw. The sources do not name affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000695,"input_tokens":4525,"output_tokens":484,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-14242':16A,19A '-2026':15A,18A 'access':68B,92C 'api':43B,102C 'author':110C 'chang':5A 'check':48B,108C 'could':34B,75C 'creat':35B,94C 'cve':14A,17A 'delet':52B,76C 'editor':2A,32B,73C 'folder':13A,46B,62B,86C,106C 'git':6A,21B,57B,81C 'git-sync':20B 'grafana':1A,23B 'host':26B 'incorrect':109C 'job':38B,41B,97C,100C 'let':50B 'manag':59B,83C 'move':53B,77C 'permiss':47B,107C 'provis':37B,96C 'pull':56B,80C 'push':54B,78C 'resourc':8A,42B,60B,84C,101C 'role':3A,33B,74C 'self':25B 'self-host':24B 'skip':45B,104C 'sync':7A,22B,58B,82C 'user':29B,70C 'vendor':27B 'view':11A,67B,91C 'view-on':10A","nicknames":[],"mitigations":[],"who_affected":"Teams running Grafana with Git Sync (provisioning) enabled and folder-level permissions that give some users view-only access while others are Editors. Instances that do not use Git Sync, or where all Editors can already modify every folder, are unlikely to gain anything from this flaw. The sources do not name affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gitsync","grafana","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-14242':16A,19A '-2026':15A,18A 'chang':5A 'cve':14A,17A 'editor':2A 'folder':13A 'git':6A 'grafana':1A 'resourc':8A 'role':3A 'sync':7A 'view':11A 'view-on':10A","search_b":"'access':68B 'api':43B 'check':48B 'could':34B 'creat':35B 'delet':52B 'editor':32B 'folder':46B,62B 'git':21B,57B 'git-sync':20B 'grafana':23B 'host':26B 'job':38B,41B 'let':50B 'manag':59B 'move':53B 'permiss':47B 'provis':37B 'pull':56B 'push':54B 'resourc':42B,60B 'role':33B 'self':25B 'self-host':24B 'skip':45B 'sync':22B,58B 'user':29B 'vendor':27B 'view':67B","search_c":"'access':92C 'api':102C 'author':110C 'check':108C 'could':75C 'creat':94C 'delet':76C 'editor':73C 'folder':86C,106C 'git':81C 'incorrect':109C 'job':97C,100C 'manag':83C 'move':77C 'permiss':107C 'provis':96C 'pull':80C 'push':78C 'resourc':84C,101C 'role':74C 'skip':104C 'sync':82C 'user':70C 'view':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T15:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-14242","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14242","severity":null,"published_at":"2026-11-11T15:17:22+00:00","modified_at":"2026-11-11T15:17:22+00:00","first_seen_at":"2026-11-11T15:27:50+00:00","fetched_at":"2026-11-11T15:27:50+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}