4.3

CVE-2026-28374

IDOR in Annotations API allows unprivileged users to DELETE annotation

Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Grafana ≫ Grafana Version >= 8.5.0 < 11.6.14
Grafana ≫ Grafana Version >= 12.2.0 < 12.2.8
Grafana ≫ Grafana Version >= 12.3.0 < 12.3.6
Grafana ≫ Grafana Version >= 12.4.0 < 12.4.3
Grafana ≫ Grafana Version 11.6.14 Update -
Grafana ≫ Grafana Version 11.6.14 Update security01
Grafana ≫ Grafana Version 12.2.8 Update -
Grafana ≫ Grafana Version 12.2.8 Update security01
Grafana ≫ Grafana Version 12.3.6 Update -
Grafana ≫ Grafana Version 12.3.6 Update security01
Grafana ≫ Grafana Version 12.4.3 Update -
Grafana ≫ Grafana Version 13.0.0
Grafana ≫ Grafana Version 13.0.1 Update -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.096
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@grafana.com 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://grafana.com/security/security-advisories/cve-2026-28374
Vendor Advisory