CVE-2026-13721: Folder authorization bypass in the Git Sync provisioning files API

Published Nov 11, 2026

Updated

A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders where they only had view access, through the provisioning files API (incorrect authorization).

Event History

Nov 11, 2026

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user needs edit access to at least one folder. That user can target Git Sync provisioned resources in other folders where they have only view access.

What actions could an attacker perform?

They could modify, move, or delete Git Sync provisioned resources through the provisioning files API. The impact described is on integrity; no confidentiality or availability impact is indicated.

Is user interaction required for exploitation?

No. The vector indicates network access with low attack complexity, low privileges, and no user interaction required.

CVE-2026-13721: Folder authorization bypass in the Git Sync provisioning files API

Event History

Frequently Asked Questions

Who can exploit this issue?

What actions could an attacker perform?

Is user interaction required for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What actions could an attacker perform?

Is user interaction required for exploitation?