CVE-2026-28374
CVE-2026-28374 · IDOR in Annotations API allows unprivileged users to DELETE annotation
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
CVSS 4.3 · Medium · EPSS 0.2%
- Published
- Updated
Stack: system · applications
Affected products and versions
grafana
- Versions
- ≥ 8.5.0, ≤ 11.6.14: Affected (semver)
- ≥ 11.6.14, < 11.6.14+security-04: Affected (custom)
- ≥ 12.0.0, ≤ 12.2.8: Affected (semver)
- ≥ 12.2.8, < 12.2.8+security-04: Affected (custom)
- ≥ 12.3.0, ≤ 12.3.6: Affected (semver)
- ≥ 12.3.6, < 12.3.6+security-04: Affected (custom)
- ≥ 12.4.0, ≤ 12.4.3: Affected (semver)
- ≥ 12.4.3, < 12.4.3+security-02: Affected (custom)
- ≥ 13.0.0, ≤ 13.0.1: Affected (semver)
- ≥ 13.0.1, < 13.0.1+security-01: Affected (custom)
No fix published
grafana Ubuntu:16.04:LTS
- Versions
- 2.6.0+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published