6.5

CVE-2026-28380

BAC in Snapshot API allows deletion of unauthorized dashboard snapshots

Any Editor could delete any snapshot, even if they have no access to read or write them.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Grafana ≫ Grafana Version >= 8.5.0 < 11.6.14
Grafana ≫ Grafana Version >= 12.2.0 < 12.2.8
Grafana ≫ Grafana Version >= 12.3.0 < 12.3.6
Grafana ≫ Grafana Version >= 12.4.0 < 12.4.3
Grafana ≫ Grafana Version11.6.14 Update-
Grafana ≫ Grafana Version11.6.14 Updatesecurity01
Grafana ≫ Grafana Version12.2.8 Update-
Grafana ≫ Grafana Version12.2.8 Updatesecurity01
Grafana ≫ Grafana Version12.3.6 Update-
Grafana ≫ Grafana Version12.3.6 Updatesecurity01
Grafana ≫ Grafana Version12.4.3 Update-
Grafana ≫ Grafana Version13.0.0
Grafana ≫ Grafana Version13.0.1 Update-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.23% 0.132
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@grafana.com 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://grafana.com/security/security-advisories/cve-2026-28380
Vendor Advisory