Privilege escalation through folder move in the folders API

published 2026-11-11 19h ago modified 2026-11-11 19h ago also EUVD-2026-123541

cvss: 7.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: —; no EPSS score yet
public exploits: 0; none known

A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move (improper privilege management).

Patch / fix

fixed in 2

Grafana Grafana Enterprise 13.0.10
Grafana Grafana OSS 13.0.10

Is CVE-2026-111000 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Affected products

Grafana Grafana Enterprise
Grafana Grafana OSS

Classification

Weakness

CWE-863 Incorrect Authorization
CWE-269 Improper Privilege Management

References

grafana.com /security/security-advisories/cve-2026-111000
vendor-advisory

Sources

CVE List CVE-2026-111000
NVD CVE-2026-111000

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.