CVSS 7.1 (high) · published 2026-11-11
A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned dashboards and folders there (incorrect authorization).
Weakness: CWE-200, CWE-636, CWE-863
Source: NVD CVE-2026-111024
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.