Grafana: Authorization bypass in Git Sync provisioning files API
Summary
A user with Editor rights on at least one folder can modify, move or delete Git Sync provisioned dashboards and folders in folders where they only have View access. The flaw is an incorrect authorization check in the provisioning files API. The attacker needs a valid account, and the CVSS impact is limited to integrity.
Affected
- Grafana Enterprise 13.0.0 to 13.0.12
- Grafana Enterprise 13.1.0 to 13.1.9
- Grafana Enterprise 13.2.0 to 13.2.5
- Grafana Enterprise 13.3.0
- Grafana OSS 13.0.0 to 13.0.12
- Grafana OSS 13.1.0 to 13.1.9
- Grafana OSS 13.2.0 to 13.2.5
- Grafana OSS 13.3.0
Default configuration of 13.3.0 is unaffected according to the CVE record.
Fixed in
Unknown. The vendor advisory does not name a fixed version in the sources reviewed. A Helm chart issue suggests Grafana 13.3.1, but this is not confirmed by Grafana.
Workaround
No vendor-confirmed workaround. Interim measures:
- Remove Editor and Admin rights that are not needed.
- Review folder permissions on provisioned folders.
- Keep provisioned repositories under change control so unauthorised changes are visible in the Git history.
Exploitation
Not known to be exploited. No public proof of concept was found, and the CVE was not listed in Metasploit, Exploit-DB or nuclei-templates as of 11 Nov 2026.
Our recommendation
- Check whether Git Sync or provisioning is used and which Grafana versions are running.
- Update to a fixed release once the Grafana advisory names it, and check the advisory for backports to 13.0.x, 13.1.x and 13.2.x.
- Until then, apply the interim measures above and monitor provisioning API activity.
- Patch together with other recent Grafana Git Sync fixes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Grafana Security Advisory CVE-2026-13721 grafana.com
- CVE-2026-13721 summary (OffSeq Radar) radar.offseq.com
- Grafana Community Helm charts issue 990 github.com
- Grafana Git Sync permissions grafana.com
- Grafana Git Sync provisioned dashboards grafana.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:24.
Original description (NVD)
A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders where they only had view access, through the provisioning files API (incorrect authorization).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.