---
id: "CVE-2026-14242"
page: "https://infrastack.ai/live/CVE-2026-14242"
kind: "vulnerability"
aliases: ["CVE-2026-14242"]
title: "Grafana: Editor role can change Git Sync resources in view-only folders"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["git-sync", "grafana", "self-hosted", "vendor"]
not_affected_if: ["git-sync-disabled", "no-folder-permissions"]
published_at: "2026-11-11T15:17:22+00:00"
first_seen_at: "2026-11-11T15:27:50+00:00"
updated_at: "2026-11-11T15:29:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14242", "first_seen_at": "2026-11-11T15:27:50+00:00"}]
exploit_sources: []
---

# Grafana: Editor role can change Git Sync resources in view-only folders

Link for people: https://infrastack.ai/live/CVE-2026-14242 (this .md is for agents)

A user with the Editor role could create a provisioning job through the jobs resource API that skipped folder permission checks. That let them delete, move, push or pull Git Sync managed resources in folders where they only had view access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-11T15:27:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-14242

## From the sources

A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorization).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_