An authenticated user with edit permission on one folder can move a library panel into another folder where the user only has view permission. The update operation does not verify the create permission on the destination folder, allowing the panel to be re‑located without proper authorization. It is inferred that the panel becomes visible to users who were previously unable to create or view it in that folder. No data from the destination folder is disclosed, and existing content there cannot be altered, yet the panel becomes visible to users who were previously unable to create or view it in that folder. This flaw enables a form of privilege escalation or unauthorized resource manipulation. The weakness is classified as CWE-639 and CWE-863.

This flaw targets Grafana Enterprise and Grafana OSS installations. Affected versions are those preceding the patch referenced in the Grafana security advisory; the specific version range is not listed in the input.

The CVSS score of 4.3 indicates low severity. Exploitation requires an authenticated user with edit access to the source folder; there is no remote code execution or direct data disclosure. The EPSS score is not available, and the issue is not listed in CISA KEV. The attack vector is limited to movement of library panels via the API, so the risk is confined to unintended access to panels but is still a real authorization issue.