CVE-2026-13721: 
Grafana vulnerability analysis and mitigation

CVE-2026-13721 is an incorrect authorization vulnerability in Grafana's provisioning files API that allows an authenticated user with edit access to one folder to modify, move, or delete Git Sync provisioned resources in folders where they only have view access. It affects Grafana OSS and Grafana Enterprise versions 13.0.0–13.0.12, 13.1.0–13.1.9, 13.2.0–13.2.5, and 13.3.0. The vulnerability was published on November 11, 2026, with a patch made available the same day. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Grafana Advisory).

The root cause is an incorrect authorization check (CWE-863) in Grafana's provisioning files API, compounded by authorization bypass through user-controlled keys (CWE-639) and incorrect behavior order (CWE-696). When a user interacts with the provisioning files API, the system fails to properly validate whether the user has edit permissions for the target folder, instead relying on the user's edit access to any folder. An authenticated, low-privileged attacker can exploit this over the network with low complexity and no user interaction required, by crafting API requests targeting Git Sync provisioned resources in folders they only have view access to (GitHub Advisory, Grafana Advisory).

Successful exploitation allows an authenticated attacker to modify, move, or delete Git Sync provisioned resources (such as dashboards, alert rules, or data source configurations) in folders beyond their authorized scope. The primary impact is on integrity — attackers can corrupt or destroy provisioned monitoring configurations — with no direct confidentiality or availability impact identified. In environments where Grafana manages critical observability infrastructure, unauthorized modification of provisioned resources could disrupt monitoring pipelines or obscure malicious activity (GitHub Advisory, Grafana Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a valid authenticated account with edit access to at least one folder, limiting the attack surface to internal or compromised users (GitHub Advisory, Grafana Advisory).

1. Authenticate: Log in to the Grafana instance with a user account that has edit access to at least one folder but only view access to other folders containing Git Sync provisioned resources.
2. Identify target resources: Enumerate folders and their provisioned resources via the Grafana API or UI to identify Git Sync provisioned dashboards, alert rules, or other resources in restricted folders.
3. Craft malicious API request: Send a crafted HTTP request to the provisioning files API endpoint, referencing the UID or path of a resource located in a folder where the attacker only has view access.
4. Perform unauthorized action: Execute a modify, move, or delete operation against the targeted provisioned resource. Due to the missing authorization check, the API processes the request without validating folder-level edit permissions.
5. Achieve objective: The attacker successfully alters or removes provisioned resources in folders they should not have write access to, potentially disrupting monitoring configurations or covering tracks (GitHub Advisory, Grafana Advisory).

• Logs: Grafana audit logs showing API calls to the provisioning files endpoint (/api/v1/provisioning/) from a user account performing write/delete operations on folders where that user only holds viewer role.
• Logs: Unexpected modification or deletion events for Git Sync provisioned resources (dashboards, alert rules) in Grafana's audit or application logs, especially from accounts not expected to have edit rights in those folders.
• Network: HTTP PUT, PATCH, or DELETE requests to Grafana's provisioning API (/api/v1/provisioning/dashboards, /api/v1/provisioning/alert-rules, etc.) originating from user sessions with mismatched folder permissions.
• Application: Sudden disappearance or unexpected changes to Git Sync provisioned resources in folders, inconsistent with scheduled Git Sync operations.

Grafana has released patched versions addressing this vulnerability: upgrade to Grafana OSS or Enterprise 13.0.13, 13.1.10, 13.2.6, or 13.3.1 (or later) depending on your current branch (GitHub Advisory, Grafana Advisory). As an interim workaround, restrict edit permissions to only the minimum necessary folders and users, and audit existing role assignments to ensure no users have unintended edit access. Review Grafana audit logs for any unauthorized modifications to provisioned resources that may have occurred prior to patching.