Grafana: Privilege escalation via folder move in folders API
Summary
An authenticated user with the Editor role who can edit a folder can move it through the folders resource API under a folder they administer. This grants them Admin rights on the moved folder and its contents, including the right to change permissions. The legacy folder move API refuses the same move, so the flaw is specific to the newer API.
Affected
- Grafana Enterprise 12.4.0 to 12.4.14
- Grafana Enterprise 13.0.0 before 13.0.10
- Grafana OSS 12.4.0 to 12.4.14 (per aggregator data; OSS listed in the CNA record but not in the CVE title; verify)
- Grafana OSS 13.0.0 before 13.0.10 (verify)
- Default configuration is unaffected according to the CNA record.
Fixed in
- Grafana 13.0.10 (per aggregator data; verify against the vendor advisory)
- Fixed version for the 12.4.x line: Unknown.
Workaround
Unknown. The vendor advisory reportedly lists no additional mitigation steps.
- Interim measure (general advice, not a confirmed vendor workaround): limit the number of users with the Editor role and with Admin rights on folders.
Exploitation
- Not known to be exploited at the time of research.
- No public proof of concept or CISA KEV entry found; the CVE was published on 2026-11-11 and status should be re-checked.
Our recommendation
- Check the Grafana version and edition on every instance.
- Upgrade to Grafana 13.0.10 or later, or apply the fix from the vendor advisory for 12.4.x, in the next maintenance window.
- Confirm the fixed versions against the Grafana advisory and NVD.
- Review which users hold Editor and folder Admin rights and remove unnecessary access.
- Monitor for changes in folder permissions and re-check exploitation status in a few days.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Grafana security advisory CVE-2026-111000 grafana.com
- OffSeq radar entry CVE-2026-111000 radar.offseq.com
- Grafana docs: Manage folder permissions grafana.com
- Grafana security advisories overview grafana.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:22.
Original description (NVD)
A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move (improper privilege management).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.