CVE-2026-111000
Received
Received - Intake
Privilege Escalation in Grafana via Folder Move API
Vulnerability report for CVE-2026-111000, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-11
Last updated on: 2026-11-11
Assigner: Grafana Labs
Description
Description
A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move (improper privilege management).
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Grafana | Grafana Enterprise | From 12.4.0 (inc) to 12.4.14 (inc) |
| Grafana | Grafana Enterprise | From 13.0.0 (inc) to 13.0.10 (exc) |
| Grafana | Grafana OSS | From 12.4.0 (inc) to 12.4.14 (inc) |
| Grafana | Grafana OSS | From 13.0.0 (inc) to 13.0.10 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
