CVE-2026-111024: Folder permission bypass in the Git Sync repository files API

Published Nov 11, 2026

Updated

A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned dashboards and folders there (incorrect authorization).

Event History

Nov 11, 2026

CVE Published

via MITRE·03:02 PM

Data Sourced

via MITRE·03:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Grafana users with Viewer or Editor roles are affected when Git Sync managed resources are present in folders protected by folder permissions. Viewers may read inaccessible files, while Editors may create, modify, move, or delete provisioned dashboards and folders in those locations.

What access does an attacker need?

An attacker needs an existing Viewer or Editor role and access to use the repository files API. No user interaction is required.

How can defenders identify possible impact?

Review use of the repository files API by Viewer and Editor accounts, especially requests involving Git Sync managed resources in folders where those accounts lack folder access. Check for unexpected reads, changes, moves, deletions, or creation of provisioned dashboards and folders.

CVE-2026-111024: Folder permission bypass in the Git Sync repository files API

Event History

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need?

How can defenders identify possible impact?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need?

How can defenders identify possible impact?