CVE-2026-28380

Published: May 13, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security@grafana.com (Secondary)

Description

Any Editor could delete any snapshot, even if they have no access to read or write them.

Affected (13)

Products: Grafana: Grafana

1 product

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Grafana Grafana	12.2.0 ≤ version < 12.2.8
Grafana Grafana	12.3.0 ≤ version < 12.3.6
Grafana Grafana	12.4.0 ≤ version < 12.4.3
Grafana Grafana	8.5.0 ≤ version < 11.6.14
Grafana Grafana	Version 11.6.14
Grafana Grafana	Version 11.6.14 security01
Grafana Grafana	Version 12.2.8
Grafana Grafana	Version 12.2.8 security01
Grafana Grafana	Version 12.3.6
Grafana Grafana	Version 12.3.6 security01
Grafana Grafana	Version 12.4.3
Grafana Grafana	Version 13.0.0
Grafana Grafana	Version 13.0.1

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (1)

https://grafana.com/security/security-advisories/cve-2026-28380

Source: security@grafana.com

Vendor Advisory

Timeline

No history available yet.