EUVD-2026-30137
GHSA-8mrj-8pc8-39jm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
AnalysisAI
Improper access control in Grafana OSS allows authenticated Editor-role users to delete any annotation instance-wide, regardless of whether they hold read or create permissions on that annotation. The flaw affects a broad version range from 8.5.0 through 13.0.1, exposing organizations to unauthorized data destruction by low-privileged internal users. No active exploitation has been identified at time of analysis (SSVC: none; EPSS: 0.03%, 8th percentile), and no public exploit code exists; real-world risk is constrained by the authentication prerequisite and partial integrity-only impact.
Technical ContextAI
Grafana OSS implements a role-based access control model in which the Editor role is intentionally scoped to limited annotation capabilities - Editors are prohibited from creating or reading certain annotations. However, the annotation deletion endpoint (CWE-284: Improper Access Control) fails to enforce the same read-access gate that governs other annotation operations, creating an authorization inconsistency. An Editor can therefore reference an annotation by its ID and issue a delete operation that the backend will honor despite the role lacking read access to that resource. The affected product is confirmed via CPE string cpe:2.3:a:grafana:grafana_oss:*:*:*:*:*:*:*:* across a wide version sweep from 8.5.0 to 13.0.1. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N confirms the root cause is not a disclosure issue but a missing authorization check on a write/delete path, consistent with CWE-284.
RemediationAI
Upgrade Grafana OSS to the appropriate security-patched release: 11.6.14+security-04 for the 8.5-11.6.x line, 12.2.8+security-04 for the 12.0-12.2.x line, 12.3.6+security-04 for the 12.3.x line, 12.4.3+security-02 for the 12.4.x line, or 13.0.1+security-01 for the 13.0.x line. Full details are available in Grafana's security advisory at https://grafana.com/security/security-advisories/cve-2026-28374. If immediate patching is not feasible, the practical compensating control is to audit and reduce Editor-role assignments to only trusted internal users, since exploitation requires an authenticated Editor session - revoking Editor privileges from any account not operationally required eliminates the attack surface entirely. There is no known configuration toggle to disable annotation deletion independently of Editor role capabilities, so role reduction is the most targeted workaround. Note that downgrading Editor accounts to Viewer role will prevent users from their normal dashboard-editing tasks, so scope this control carefully.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| SUSE Manager Client Tools 15 | Fixed |
| SUSE Manager Client Tools for SLE 15 | Fixed |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Multi Linux Manager Tools SLE-15 | Fixed |
| ses/7.1/ceph/grafana ses/7/ceph/grafana suse/multi-linux-manager/5.2/x86_64/monitoring-grafana | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today