CVE-2026-13721

EUVD-2026-123536
A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders where they only had view access, through the provisioning files API (incorrect authorization).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GRAFANACNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
grafanagrafana
13.0.0 ≤
𝑥
≤ 13.0.12
CNA
grafanagrafana
13.1.0 ≤
𝑥
≤ 13.1.9
CNA
grafanagrafana
13.2.0 ≤
𝑥
≤ 13.2.5
CNA
grafanagrafana
13.3.0
CNA
Common Weakness Enumeration
References
https://grafana.com/security/security-advisories/cve-2026-13721