Medium severity6.5NVD Advisory· Published Nov 11, 2026

CVE-2026-13721

Description

A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders where they only had view access, through the provisioning files API (incorrect authorization).

Affected products

Grafana/Grafana Plugin SDK Goinferred
Grafana/Git Syncllm-fuzzy

Patches

Vulnerability mechanics

References

grafana.com/security/security-advisories/cve-2026-13721nvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000