Answer in brief
CVE-2026-111000 records a High severity (CVSS 7.1) vulnerability in Privilege escalation through folder move in the folders API. The current sources do not mark it as known exploited. The current feed maps Grafana/Grafana Enterprise (generic), Grafana/Grafana OSS (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Grafana/Grafana Enterprise (generic), Grafana/Grafana OSS (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Grafana/Grafana Enterprisegeneric | >=12.4.0 <=12.4.14 || >=13.0.0 <13.0.10 | 13.0.10 |
| Grafana/Grafana OSSgeneric | >=12.4.0 <=12.4.14 || >=13.0.0 <13.0.10 | 13.0.10 |
Published upstream
Nov 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 11, 2026
A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move (improper privilege management).
Quoted source text, attributed separately from HOL analysis.