CVE-2026-111000: 
Grafana vulnerability analysis and mitigation

CVE-2026-111000 is a privilege escalation vulnerability in Grafana OSS and Grafana Enterprise affecting the folders resource API. An authenticated user with the Editor role can move a folder they can edit into a folder they administer, thereby gaining Admin-level access to the moved folder and all its contents — including the ability to modify permissions. The vulnerability affects Grafana OSS and Enterprise versions 12.4.0 through 12.4.14 and 13.0.0 through 13.0.9. It was published on November 11, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory).

The root cause is improper privilege management (CWE-269) combined with incorrect authorization (CWE-863) in the folders resource API. When an Editor-role user invokes the modern folders resource API to move a folder, the API fails to enforce the restriction that the user must not gain elevated privileges as a result of the move — specifically, it does not check whether the destination folder grants the user Admin rights over the source folder. Notably, the legacy folder move API correctly refuses this operation, indicating the flaw was introduced in the newer API implementation. The attack is network-accessible, requires only low privileges (an Editor account), and no user interaction (GitHub Advisory).

A successful exploit allows an authenticated Editor-role user to escalate their privileges to Admin on any folder they can move, including all dashboards, data sources, and nested content within that folder. This grants the attacker the ability to modify permissions on the affected resources, potentially exposing sensitive monitoring data, altering dashboard configurations, or granting other users unauthorized access. The confidentiality impact is rated Low (limited data exposure) while the integrity impact is rated High, reflecting the attacker's ability to alter access controls and content (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a valid Editor-role account on the target Grafana instance, limiting the attack surface to authenticated users (GitHub Advisory).

1. Obtain Editor credentials: Authenticate to the target Grafana instance using an account with the Editor role that has edit access to at least one folder.
2. Identify target folder: Locate a folder the Editor can edit (source folder) and a separate folder the Editor administers (destination folder).
3. Invoke the folders resource API: Send an authenticated HTTP request to the modern folders resource API endpoint (e.g., PATCH /api/folders/{uid}) with a payload specifying the destination folder UID as the new parent, moving the source folder under the administered destination.
4. Gain Admin access: After the move, the API grants the attacker Admin-level permissions on the moved folder and all its contents, including dashboards and nested folders.
5. Modify permissions: Use the newly acquired Admin rights to alter folder permissions, grant access to other accounts, or access data previously restricted from the Editor role (GitHub Advisory).

• Logs: Grafana audit logs showing PATCH /api/folders/{uid} requests from Editor-role users that result in a folder being moved to a new parent; subsequent permission change events on the same folder shortly after the move.
• Logs: Unexpected admin role assignments or permission modifications on folders performed by accounts that hold only the Editor role.
• Network: Authenticated API calls to the folders resource endpoint (/api/folders/) with parentUid parameters being set to folders not previously associated with the requesting user's edit scope.
• Behavioral: An Editor-role user accessing or modifying dashboards or data sources in folders they did not previously have Admin access to.

Grafana has released patched versions addressing this vulnerability: upgrade to Grafana OSS or Enterprise 12.4.15 (for the 12.4.x branch) or 13.0.10 or later (for the 13.0.x branch). As an interim workaround where immediate patching is not possible, administrators should consider restricting the Editor role's ability to move folders, and should audit existing folder permission assignments to identify any unauthorized privilege escalations that may have already occurred. Reviewing and tightening folder access controls is recommended regardless of patch status (GitHub Advisory).