CVE-2026-28374
Full vulnerability record from the local CVENow database.
Description
Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
Severity
MEDIUM
CVSS score
4.3
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-05-13 20:16:19.583000
Last modified
2026-10-26 14:10:00.130000
View original CVE JSON
{
"id": "CVE-2026-28374",
"sourceIdentifier": "[email protected]",
"published": "2026-05-13T20:16:19.583",
"lastModified": "2026-10-26T14:10:00.130",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations."
},
{
"lang": "es",
"value": "Los editores podrían eliminar cualquier anotación, incluso aquellas a las que no tienen acceso de lectura. El usuario editor no puede crear ni leer las anotaciones."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Grafana",
"product": "Grafana OSS",
"defaultStatus": "unaffected",
"versions": [
{
"version": "8.5.0",
"lessThanOrEqual": "11.6.14",
"versionType": "semver",
"status": "affected"
},
{
"version": "11.6.14",
"lessThan": "11.6.14+security-04",
"versionType": "custom",
"status": "affected"
},
{
"version": "12.0.0",
"lessThanOrEqual": "12.2.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.2.8",
"lessThan": "12.2.8+security-04",
"versionType": "custom",
"status": "affected"
},
{
"version": "12.3.0",
"lessThanOrEqual": "12.3.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.3.6",
"lessThan": "12.3.6+security-04",
"versionType": "custom",
"status": "affected"
},
{
"version": "12.4.0",
"lessThanOrEqual": "12.4.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.4.3",
"lessThan": "12.4.3+security-02",
"versionType": "custom",
"status": "affected"
},
{
"version": "13.0.0",
"lessThanOrEqual": "13.0.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "13.0.1",
"lessThan": "13.0.1+security-01",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-14T12:32:58.713813Z",
"id": "CVE-2026-28374",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.5.0",
"versionEndExcluding": "11.6.14",
"matchCriteriaId": "3EB52192-B43E-44FD-A838-245DD579DF4E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.2.0",
"versionEndExcluding": "12.2.8",
"matchCriteriaId": "37747AB2-8B5F-4BD3-860E-0C092A9F78F0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.3.0",
"versionEndExcluding": "12.3.6",
"matchCriteriaId": "870FE01F-86F1-4734-9CC3-6FC9AF3012C5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.4.0",
"versionEndExcluding": "12.4.3",
"matchCriteriaId": "4451FBC6-6277-4DD8-B143-0DAE82175D9A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:11.6.14:-:*:*:*:*:*:*",
"matchCriteriaId": "548C63DC-4E7F-4D9E-B2F0-AB24A66E0F7F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:11.6.14:security01:*:*:*:*:*:*",
"matchCriteriaId": "5F103470-1371-498E-9442-11EA7C2E3A6B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.2.8:-:*:*:*:*:*:*",
"matchCriteriaId": "4ACC0DB6-8BC4-4975-AD26-D41F69571EF6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.2.8:security01:*:*:*:*:*:*",
"matchCriteriaId": "9EBE773D-17BB-4402-B0B8-74D3DD79B32C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.3.6:-:*:*:*:*:*:*",
"matchCriteriaId": "6A58801D-1713-4A52-8713-9DD31F75698D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.3.6:security01:*:*:*:*:*:*",
"matchCriteriaId": "5C930B25-FD06-477C-B226-DEB486A46DAA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.4.3:-:*:*:*:*:*:*",
"matchCriteriaId": "172F03B1-E693-4EF3-90A0-D40773E4ACB4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:13.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0F0B8E4F-ADE7-4594-9241-966B1F0BC440"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:13.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "2AD87DC5-DF20-4993-A11B-91EBB313A40A"
}
]
}
]
}
],
"references": [
{
"url": "https://grafana.com/security/security-advisories/cve-2026-28374",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}