What is CVE-2026-13721?

CVE-2026-13721 is a security advisory published by Grafana Labs Security. Folder authorization bypass in the Git Sync provisioning files API

Why does CVE-2026-13721 name no CVE ID?

As we last read it, Grafana Labs Security's advisory lists no CVE ID. A vendor can publish an advisory before a CVE record exists for the flaw, and some advisories never get one. CVE IDs are assigned by CVE Numbering Authorities, not by NVD, and we have not measured when, or whether, a CVE record follows.

CVE-2026-13721No CVE ID named

Folder authorization bypass in the Git Sync provisioning files API

Vendor

Grafana Labs Security

Published

November 10, 2026

Last Modified

—

📋 Description

A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders where they only had view access, through the provisioning files API (incorrect authorization). Thanks to igzs for reporting this vulnerability to us via our bug bounty program.

🔗 References (1)

advisoryhttps://grafana.com/security/security-advisories/cve-2026-13721/