PT-2026-145249

CVE-2026-111024

Published

2026-11-11

Updated

2026-11-11

Description by

CVSS 3.1

7.1

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned dashboards and folders there (incorrect authorization).

Exploitability

Fix

Impacts

Researchers

Naxxan1337

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-636: Not Failing Securely (\'Failing Open\')

CWE-863: Incorrect Authorization

Related identifiers