Improper Privilege Management in Grafana Folders by Grafana Labs

CVE-2026-111000

What is CVE-2026-111000?

A vulnerability exists in the Grafana platform that allows users with the Editor role to manipulate folder permissions improperly. Specifically, an authenticated Editor can move folders they manage into another folder that they administer, inadvertently granting themselves admin rights over the moved folder and its contents. This action circumvents expected permission controls and allows for permission changes that could compromise the security of the folder's data.

References