Grafana: Authorization Bypass via Git Sync (CVE-2026-111024)
Grafana Git Sync contains an authorization bypass vulnerability (CVE-2026-111024) allowing users with Viewer or Editor roles to perform unauthorized actions on protected folders and dashboards.
CVE search metadata
CVE search record: CVE-2026-111024. Severity: high. CVSS: 7.1. KEV: no. Product: Grafana. Brief: Grafana: Authorization Bypass via Git Sync (CVE-2026-111024). Brief link: https://feed.craftedsignal.io/briefs/2026-11-grafana-auth-bypass-cve-2026-111024/
Triage facts
Revision 1- Applicability
- Grafana
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 16:16 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-111024 is an authorization bypass vulnerability in the Git Sync feature of Grafana. Users assigned with the Viewer or Editor role can bypass folder-level permissions when interacting with the repository files API. This allows Viewers to read files in restricted folders and Editors to manipulate, move, or delete provisioned dashboards and folders that should be protected.
Impact
A malicious user with limited 'Viewer' or 'Editor' roles can exceed their intended access level, leading to unauthorized data disclosure and unauthorized modification or destruction of provisioned resources.
Immediate actions
Audit current Grafana user permissions and restrict access to Git Sync managed repositories.
Threat Hunt
Monitor audit logs for unexpected repository files API access by users with Viewer or Editor roles.
Data: Grafana audit logs, API access logs