EUVD-2026-30137
GHSA-8mrj-8pc8-39jm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
AnalysisAI
Improper access control in Grafana OSS allows authenticated Editor-role users to delete any annotation instance-wide, regardless of whether they hold read or create permissions on that annotation. The flaw affects a broad version range from 8.5.0 through 13.0.1, exposing organizations to unauthorized data destruction by low-privileged internal users. No active exploitation has been identified at time of analysis (SSVC: none; EPSS: 0.03%, 8th percentile), and no public exploit code exists; real-world risk is constrained by the authentication prerequisite and partial integrity-only impact.
Technical ContextAI
Grafana OSS implements a role-based access control model in which the Editor role is intentionally scoped to limited annotation capabilities - Editors are prohibited from creating or reading certain annotations. However, the annotation deletion endpoint (CWE-284: Improper Access Control) fails to enforce the same read-access gate that governs other annotation operations, creating an authorization inconsistency. An Editor can therefore reference an annotation by its ID and issue a delete operation that the backend will honor despite the role lacking read access to that resource. The affected product is confirmed via CPE string cpe:2.3:a:grafana:grafana_oss:*:*:*:*:*:*:*:* across a wide version sweep from 8.5.0 to 13.0.1. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N confirms the root cause is not a disclosure issue but a missing authorization check on a write/delete path, consistent with CWE-284.
RemediationAI
Upgrade Grafana OSS to the appropriate security-patched release: 11.6.14+security-04 for the 8.5-11.6.x line, 12.2.8+security-04 for the 12.0-12.2.x line, 12.3.6+security-04 for the 12.3.x line, 12.4.3+security-02 for the 12.4.x line, or 13.0.1+security-01 for the 13.0.x line. Full details are available in Grafana's security advisory at https://grafana.com/security/security-advisories/cve-2026-28374. If immediate patching is not feasible, the practical compensating control is to audit and reduce Editor-role assignments to only trusted internal users, since exploitation requires an authenticated Editor session - revoking Editor privileges from any account not operationally required eliminates the attack surface entirely. There is no known configuration toggle to disable annotation deletion independently of Editor role capabilities, so role reduction is the most targeted workaround. Note that downgrading Editor accounts to Viewer role will prevent users from their normal dashboard-editing tasks, so scope this control carefully.
More in Grafana Oss
View allPrivilege revocation race condition in Grafana OSS allows a user whose service-account token-minting permission was just
Authentication bypass in Grafana OSS Auth Proxy allows remote attackers to circumvent IPv6 allow-list restrictions becau
Privilege escalation in Grafana OSS allows an authenticated Editor with write access to a dashboard they do not own to o
Uncontrolled resource consumption in Grafana OSS allows authenticated low-privilege users to trigger an out-of-memory (O
Unbounded memory allocation in Grafana OSS's Live push endpoint allows any authenticated user to exhaust server memory b
Grafana Live's concurrent request handling exposes authenticated Viewer-role users as a denial-of-service vector: sendin
Unbounded memory allocation in Grafana OSS's plugin resources endpoint allows any authenticated low-privileged user to t
Arbitrary file read in Grafana OSS exposes server filesystem contents to authenticated low-privilege users when the sqlE
Missing authorization in Grafana OSS's snapshot deletion endpoint allows any authenticated Editor-role user to delete ar
Grafana OSS exposes an unauthenticated or low-privilege denial-of-service path through its alertmanager templates test e
Cross-organization authorization bypass in Grafana OSS and Enterprise allows an authenticated Org Admin to delete public
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| SUSE Manager Client Tools 15 | Fixed |
| SUSE Manager Client Tools for SLE 15 | Fixed |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Multi Linux Manager Tools SLE-15 | Fixed |
| ses/7.1/ceph/grafana ses/7/ceph/grafana suse/multi-linux-manager/5.2/x86_64/monitoring-grafana | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today