CVE-2026-14242: Authorization bypass in the Git Sync provisioning jobs API

Published Nov 11, 2026

Updated

A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorization).

Event History

Nov 11, 2026

CVE Published

via MITRE·03:01 PM

Data Sourced

via MITRE·03:01 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A user assigned the Editor role can exploit it. The issue applies when that user has only view access to the folders containing Git Sync managed resources.

What access and interface does an attacker need?

The attacker needs authenticated Editor-level access and must be able to create a provisioning job through the jobs resource API. No user interaction is required.

What actions could an attacker perform?

They could delete, move, push, or pull Git Sync managed resources in folders where they should have only view access.

CVE-2026-14242: Authorization bypass in the Git Sync provisioning jobs API

Event History

Frequently Asked Questions

Who can exploit this issue?

What access and interface does an attacker need?

What actions could an attacker perform?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access and interface does an attacker need?

What actions could an attacker perform?