Grafana: Folder permission bypass in Git Sync repository files API
Summary
Grafana Enterprise and OSS versions 13.0.2 to 13.0.12, 13.1.0 to 13.1.9, 13.2.0 to 13.2.5 and 13.3.0 are listed as affected; the default configuration of 13.3.0 is unaffected. A user with the Viewer or Editor role can bypass folder permissions on Git Sync-managed resources through the repository files API. A Viewer can read files in folders they cannot access, and an Editor can create, modify, move or delete provisioned dashboards and folders there. The attacker needs a valid low-privilege account, and the CVSS score of 7.1 is the submitted value, not yet verified by NVD.
Affected
- Grafana Enterprise: 13.0.2 to 13.0.12, 13.1.0 to 13.1.9, 13.2.0 to 13.2.5, 13.3.0
- Grafana OSS: 13.0.2 to 13.0.12, 13.1.0 to 13.1.9, 13.2.0 to 13.2.5, 13.3.0
- Default configuration of 13.3.0 is unaffected according to the CVE record
Fixed in
Unknown. The fixed releases are not stated in the available sources; check the Grafana security advisory.
Workaround
Unknown. No vendor-confirmed workaround found.
- Limit the Viewer and Editor roles and Git Sync-managed folders to users who need them.
Exploitation
Unknown. No public reports of exploitation, proof of concept or CISA KEV entry were found at the time of analysis.
Our recommendation
- Check whether Grafana runs an affected version and whether Git Sync is enabled.
- Review Viewer and Editor role assignments and the folders managed by Git Sync.
- Plan the upgrade to the fixed release named in the Grafana advisory as soon as it is confirmed.
- Monitor the advisory and the NVD record for updates to the affected ranges.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Grafana security advisory CVE-2026-111024 grafana.com
- Git Sync permissions in Grafana (documentation) grafana.com
- Git Sync for Grafana dashboards and folders now generally available grafana.com
- Grafana community Helm charts issue 990 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:22.
Original description (NVD)
A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned dashboards and folders there (incorrect authorization).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.