6.5

CVE-2026-28380

BAC in Snapshot API allows deletion of unauthorized dashboard snapshots

Any Editor could delete any snapshot, even if they have no access to read or write them.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Grafana ≫ Grafana Version >= 8.5.0 < 11.6.14
Grafana ≫ Grafana Version >= 12.2.0 < 12.2.8
Grafana ≫ Grafana Version >= 12.3.0 < 12.3.6
Grafana ≫ Grafana Version >= 12.4.0 < 12.4.3
Grafana ≫ Grafana Version 11.6.14 Update -
Grafana ≫ Grafana Version 11.6.14 Update security01
Grafana ≫ Grafana Version 12.2.8 Update -
Grafana ≫ Grafana Version 12.2.8 Update security01
Grafana ≫ Grafana Version 12.3.6 Update -
Grafana ≫ Grafana Version 12.3.6 Update security01
Grafana ≫ Grafana Version 12.4.3 Update -
Grafana ≫ Grafana Version 13.0.0
Grafana ≫ Grafana Version 13.0.1 Update -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.23% 0.132
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@grafana.com 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://grafana.com/security/security-advisories/cve-2026-28380
Vendor Advisory