EUVD-2026-30140
GHSA-29p4-5443-x453
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
Any Editor could delete any snapshot, even if they have no access to read or write them.
AnalysisAI
Missing authorization in Grafana OSS's snapshot deletion endpoint allows any authenticated Editor-role user to delete arbitrary snapshots across the platform, regardless of whether they hold read or write access to those snapshots. Affected versions span a wide release range from 9.4.0 through 13.0.1 across multiple major branches (CPE: cpe:2.3:a:grafana:grafana_oss). With EPSS at 0.03% (8th percentile), SSVC exploitation rated none, and no public exploit identified at time of analysis, the practical threat is primarily insider abuse or compromised Editor credentials being used to destroy monitoring data outside an attacker's legitimate scope.
Technical ContextAI
Grafana OSS is an open-source observability and dashboarding platform identified by CPE cpe:2.3:a:grafana:grafana_oss. Its snapshot feature allows users to publish point-in-time copies of dashboards as shareable, externally accessible URLs. The root cause, CWE-862 (Missing Authorization), indicates the snapshot deletion API endpoint fails to perform object-level access control checks - it validates that the caller holds an Editor role but does not verify whether that Editor has read or write permissions scoped to the specific snapshot being deleted. This is a classic Broken Object Level Authorization (BOLA) pattern within Grafana's RBAC model, where role-level checks are present but resource-level authorization is absent for this particular destructive operation.
RemediationAI
Upgrade to the appropriate vendor-patched release for your current branch: 11.6.14+security-04, 12.2.8+security-04, 12.3.6+security-04, 12.4.3+security-02, or 13.0.1+security-01, as confirmed by Grafana's security advisory at https://grafana.com/security/security-advisories/cve-2026-28380. As a compensating control prior to patching, audit and aggressively restrict Editor-role assignments to only fully trusted personnel, reducing the pool of accounts capable of exploitation - note this does not eliminate the vulnerability, only limits exposure. Alternatively, disabling the Grafana snapshot feature entirely via grafana.ini (set [snapshots] enabled = false) removes the attack surface completely at the cost of losing the snapshot sharing workflow for all users. No workarounds that surgically restrict snapshot deletion without disabling the feature entirely are evident from available data.
More in Grafana Oss
View allPrivilege revocation race condition in Grafana OSS allows a user whose service-account token-minting permission was just
Authentication bypass in Grafana OSS Auth Proxy allows remote attackers to circumvent IPv6 allow-list restrictions becau
Privilege escalation in Grafana OSS allows an authenticated Editor with write access to a dashboard they do not own to o
Uncontrolled resource consumption in Grafana OSS allows authenticated low-privilege users to trigger an out-of-memory (O
Unbounded memory allocation in Grafana OSS's Live push endpoint allows any authenticated user to exhaust server memory b
Grafana Live's concurrent request handling exposes authenticated Viewer-role users as a denial-of-service vector: sendin
Unbounded memory allocation in Grafana OSS's plugin resources endpoint allows any authenticated low-privileged user to t
Arbitrary file read in Grafana OSS exposes server filesystem contents to authenticated low-privilege users when the sqlE
Grafana OSS exposes an unauthenticated or low-privilege denial-of-service path through its alertmanager templates test e
Improper access control in Grafana OSS allows authenticated Editor-role users to delete any annotation instance-wide, re
Cross-organization authorization bypass in Grafana OSS and Enterprise allows an authenticated Org Admin to delete public
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| SUSE Manager Client Tools 15 | Fixed |
| SUSE Manager Client Tools for SLE 15 | Fixed |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Multi Linux Manager Tools SLE-15 | Fixed |
| ses/7.1/ceph/grafana ses/7/ceph/grafana suse/multi-linux-manager/5.2/x86_64/monitoring-grafana | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today