Grafana OSS CVE-2026-28380

Exploitation requires a valid Grafana session with at minimum an Editor role (confirmed by CVSS PR:L). The Grafana snapshot feature must be in use and enabled - instances where snapshots have never been created or the feature is disabled present no attack surface. Critically, the attacker must be able to identify or enumerate snapshot IDs belonging to snapshots outside their legitimate access scope; snapshot IDs in Grafana are typically random strings, so brute-force enumeration is impractical without prior knowledge (e.g., from a shared link or API enumeration with broader read access). Unauthenticated users and Viewer-role users cannot exploit this vulnerability. Single-tenant deployments where all users have equal access to all dashboards face no meaningful data segregation risk from this issue.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N scores 6.5 (Medium), reflecting network-accessible, low-complexity exploitation with a low-privilege prerequisite, yielding high integrity impact but no confidentiality or availability loss. EPSS at 0.03% (8th percentile) indicates very low observed exploitation probability in the wild. SSVC corroborates this: exploitation is none, automatable is no, and technical impact is only partial - consistent with an attack requiring a valid Editor credential and specific knowledge of a target snapshot ID. No KEV listing exists and no public exploit code has been identified. The risk is most relevant to multi-tenant Grafana deployments where Editor roles are distributed across separate teams with data segregation requirements - a compromised or malicious Editor could selectively destroy snapshots belonging to other teams. Organizations running single-tenant Grafana with uniformly trusted Editor users face minimal incremental risk beyond what existing Editor access already permits.

An authenticated Grafana user holding an Editor role enumerates snapshot IDs - discoverable through Grafana's UI, API, or shared links distributed within the organization - belonging to dashboards outside their access scope. The Editor then issues a DELETE request to the Grafana snapshot API targeting one of these foreign snapshot IDs; the server processes the deletion without validating object-level permissions, successfully destroying the snapshot. No public exploit code has been identified, so exploitation currently requires manual interaction rather than automated tooling.