Grafana: Authorization bypass in Git Sync provisioning jobs API
Summary
Grafana OSS and Grafana Enterprise are affected by an authorization bypass in the Git Sync provisioning jobs API. A user with the Editor role can delete, move, push or pull Git Sync managed resources in folders where they only have view access, because creating a provisioning job through the jobs resource API skips the folder permission checks. The attacker needs a valid account with the Editor role, and the flaw only matters where Git Sync is used on an affected version. The CVSS vector indicates an integrity impact only.
Affected
- Grafana OSS 13.0.0 to 13.0.12
- Grafana OSS 13.1.0 to 13.1.9
- Grafana OSS 13.2.0 to 13.2.5
- Grafana OSS 13.3.0 (default configuration unaffected)
- Grafana Enterprise 13.0.0 to 13.0.12
- Grafana Enterprise 13.1.0 to 13.1.9
- Grafana Enterprise 13.2.0 to 13.2.5
- Grafana Enterprise 13.3.0 (default configuration unaffected)
- Older branches: Unknown.
Fixed in
- Grafana 13.3.1 contains the fix according to the Grafana release notes.
- Fixed builds for the 13.0.x, 13.1.x and 13.2.x branches: Unknown. Check the vendor advisory before assuming a backport.
Workaround
- No vendor-published workaround found.
- Restrict the Editor role to users who need it.
- Limit Git Sync use to a small set of trusted administrators.
Exploitation
- No evidence of exploitation in the wild or public proof of concept found in the sources reviewed.
- CISA KEV status not verified.
Our recommendation
- If Git Sync is used on an affected version, plan an upgrade to 13.3.1 or a later release, after confirming the fixed version for your branch in the vendor advisory.
- Until the upgrade, review Editor role membership and Git Sync usage.
- Keep recent backups of Git Sync managed folders so that deletions or moves can be reverted.
- Monitor audit logs for changes to Git Sync managed dashboards and folders.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Grafana Security Advisory CVE-2026-14242 grafana.com
- Grafana v13.3.1 release github.com
- Grafana Git Sync permissions documentation grafana.com
- OffSeq Radar: CVE-2026-14242 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:24.
Original description (NVD)
A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorization).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.