Cpe:2.3:a:grafana_labs:grafana:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3agrafana_labsgrafana/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 16:16:10 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGrafana: Authorization Bypass via Git Sync (CVE-2026-111024)https://feed.craftedsignal.io/briefs/2026-11-grafana-auth-bypass-cve-2026-111024/Wed, 11 Nov 2026 16:16:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-grafana-auth-bypass-cve-2026-111024/Grafana Git Sync contains an authorization bypass vulnerability (CVE-2026-111024) allowing users with Viewer or Editor roles to perform unauthorized actions on protected folders and dashboards.CVE-2026-111024 is an authorization bypass vulnerability in the Git Sync feature of Grafana. Users assigned with the Viewer or Editor role can bypass folder-level permissions when interacting with the repository files API. This allows Viewers to read files in restricted folders and Editors to manipulate, move, or delete provisioned dashboards and folders that should be protected.

Impact

A malicious user with limited 'Viewer' or 'Editor' roles can exceed their intended access level, leading to unauthorized data disclosure and unauthorized modification or destruction of provisioned resources.

]]>highadvisoryauthorization-bypassprivilege-escalationcloud