CVE-2026-13721
Received
Received - Intake
Git Sync Provisioning Files Authorization Bypass
Vulnerability report for CVE-2026-13721, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-11
Last updated on: 2026-11-11
Assigner: Grafana Labs
Description
Description
A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders where they only had view access, through the provisioning files API (incorrect authorization).
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Grafana | Grafana Enterprise | From 13.0.0 (inc) to 13.0.12 (inc) |
| Grafana | Grafana Enterprise | From 13.1.0 (inc) to 13.1.9 (inc) |
| Grafana | Grafana Enterprise | From 13.2.0 (inc) to 13.2.5 (inc) |
| Grafana | Grafana Enterprise | 13.3.0 |
| Grafana | Grafana OSS | From 13.0.0 (inc) to 13.0.12 (inc) |
| Grafana | Grafana OSS | From 13.1.0 (inc) to 13.1.9 (inc) |
| Grafana | Grafana OSS | From 13.2.0 (inc) to 13.2.5 (inc) |
| Grafana | Grafana OSS | 13.3.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-696 | The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses. |
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
