Detections
Analytics
CVE-2026-111024
high
Description
A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned dashboards and folders there (incorrect authorization).
References
https://grafana.com/security/security-advisories/cve-2026-111024