What is CVE-2026-14242?

CVE-2026-14242 is a security advisory published by Grafana Labs Security. Authorization bypass in the Git Sync provisioning jobs API

Why does CVE-2026-14242 name no CVE ID?

As we last read it, Grafana Labs Security's advisory lists no CVE ID. A vendor can publish an advisory before a CVE record exists for the flaw, and some advisories never get one. CVE IDs are assigned by CVE Numbering Authorities, not by NVD, and we have not measured when, or whether, a CVE record follows.

CVE-2026-14242No CVE ID named

Authorization bypass in the Git Sync provisioning jobs API

Vendor

Grafana Labs Security

Published

November 10, 2026

Last Modified

—

📋 Description

A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorization). Thanks to igzs2 for reporting this vulnerability to us via our bug bounty program.

🔗 References (1)

advisoryhttps://grafana.com/security/security-advisories/cve-2026-14242/