What is CVE-2026-111024?

CVE-2026-111024 is a security advisory published by Grafana Labs Security. Folder permission bypass in the Git Sync repository files API

Why does CVE-2026-111024 name no CVE ID?

As we last read it, Grafana Labs Security's advisory lists no CVE ID. A vendor can publish an advisory before a CVE record exists for the flaw, and some advisories never get one. CVE IDs are assigned by CVE Numbering Authorities, not by NVD, and we have not measured when, or whether, a CVE record follows.

CVE-2026-111024No CVE ID named

Folder permission bypass in the Git Sync repository files API

Vendor

Grafana Labs Security

Published

November 10, 2026

Last Modified

—

📋 Description

A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned dashboards and folders there (incorrect authorization). Thanks to naxxan1337 for reporting this vulnerability to us via our vulnerability disclosure program.

🔗 References (1)

advisoryhttps://grafana.com/security/security-advisories/cve-2026-111024/