CVE-2026-28380
CVE-2026-28380 · BAC in Snapshot API allows deletion of unauthorized dashboard snapshots
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Any Editor could delete any snapshot, even if they have no access to read or write them.
CVSS 6.5 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: system · applications
Affected products and versions
grafana
- Versions
- ≥ 9.4.0, ≤ 11.6.14: Affected (semver)
- ≥ 11.6.14, < 11.6.14+security-04: Affected (custom)
- ≥ 12.0.0, ≤ 12.2.8: Affected (semver)
- ≥ 12.2.8, < 12.2.8+security-04: Affected (custom)
- ≥ 12.3.0, ≤ 12.3.6: Affected (semver)
- ≥ 12.3.6, < 12.3.6+security-04: Affected (custom)
- ≥ 12.4.0, ≤ 12.4.3: Affected (semver)
- ≥ 12.4.3, < 12.4.3+security-02: Affected (custom)
- ≥ 13.0.0, ≤ 13.0.1: Affected (semver)
- ≥ 13.0.1, < 13.0.1+security-01: Affected (custom)
Update to 11.6.14+security-04; Update to 12.2.8+security-04; Update to 12.3.6+security-04; Update to 12.4.3+security-02; Update to 13.0.1+security-01
grafana Ubuntu:16.04:LTS
- Versions
- 2.6.0+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published