Authorization Bypass in Grafana's Repository Files API
CVE-2026-111024

7.1HIGH

Key Information:

Vendor

Grafana
Status
Grafana Enterprise
Grafana Oss
Vendor
CVE Published:
11 November 2026

What is CVE-2026-111024?

An issue in Grafana's Repository Files API allows users with Viewer or Editor roles to bypass folder permissions. This flaw enables Viewers to access files in folders that should be restricted, while Editors can create, modify, move, or delete dashboards and folders they're unauthorized to handle. This vulnerability poses a significant risk to the integrity of managed resources and can lead to unauthorized changes within the application, making it critical for administrators to implement the latest security updates.

Affected Version(s)

Grafana Enterprise 13.0.2 <= 13.0.12

Grafana Enterprise 13.1.0 <= 13.1.9

Grafana Enterprise 13.2.0 <= 13.2.5

References

https://grafana.com/security/security-advisories/cve-2026...
vendor-advisory

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

naxxan1337
.