CVE-2026-28380
Full vulnerability record from the local CVENow database.
Description
Any Editor could delete any snapshot, even if they have no access to read or write them.
Severity
MEDIUM
CVSS score
6.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-05-13 20:16:20.023000
Last modified
2026-10-26 14:10:00.130000
View original CVE JSON
{
"id": "CVE-2026-28380",
"sourceIdentifier": "[email protected]",
"published": "2026-05-13T20:16:20.023",
"lastModified": "2026-10-26T14:10:00.130",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Any Editor could delete any snapshot, even if they have no access to read or write them."
},
{
"lang": "es",
"value": "Cualquier editor podría eliminar cualquier instantánea, incluso si no tienen acceso para leerlas o escribirlas."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Grafana",
"product": "Grafana OSS",
"defaultStatus": "unaffected",
"versions": [
{
"version": "9.4.0",
"lessThanOrEqual": "11.6.14",
"versionType": "semver",
"status": "affected"
},
{
"version": "11.6.14",
"lessThan": "11.6.14+security-04",
"versionType": "custom",
"status": "affected"
},
{
"version": "12.0.0",
"lessThanOrEqual": "12.2.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.2.8",
"lessThan": "12.2.8+security-04",
"versionType": "custom",
"status": "affected"
},
{
"version": "12.3.0",
"lessThanOrEqual": "12.3.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.3.6",
"lessThan": "12.3.6+security-04",
"versionType": "custom",
"status": "affected"
},
{
"version": "12.4.0",
"lessThanOrEqual": "12.4.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.4.3",
"lessThan": "12.4.3+security-02",
"versionType": "custom",
"status": "affected"
},
{
"version": "13.0.0",
"lessThanOrEqual": "13.0.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "13.0.1",
"lessThan": "13.0.1+security-01",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-14T15:54:58.435055Z",
"id": "CVE-2026-28380",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.5.0",
"versionEndExcluding": "11.6.14",
"matchCriteriaId": "3EB52192-B43E-44FD-A838-245DD579DF4E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.2.0",
"versionEndExcluding": "12.2.8",
"matchCriteriaId": "37747AB2-8B5F-4BD3-860E-0C092A9F78F0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.3.0",
"versionEndExcluding": "12.3.6",
"matchCriteriaId": "870FE01F-86F1-4734-9CC3-6FC9AF3012C5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.4.0",
"versionEndExcluding": "12.4.3",
"matchCriteriaId": "4451FBC6-6277-4DD8-B143-0DAE82175D9A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:11.6.14:-:*:*:*:*:*:*",
"matchCriteriaId": "548C63DC-4E7F-4D9E-B2F0-AB24A66E0F7F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:11.6.14:security01:*:*:*:*:*:*",
"matchCriteriaId": "5F103470-1371-498E-9442-11EA7C2E3A6B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.2.8:-:*:*:*:*:*:*",
"matchCriteriaId": "4ACC0DB6-8BC4-4975-AD26-D41F69571EF6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.2.8:security01:*:*:*:*:*:*",
"matchCriteriaId": "9EBE773D-17BB-4402-B0B8-74D3DD79B32C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.3.6:-:*:*:*:*:*:*",
"matchCriteriaId": "6A58801D-1713-4A52-8713-9DD31F75698D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.3.6:security01:*:*:*:*:*:*",
"matchCriteriaId": "5C930B25-FD06-477C-B226-DEB486A46DAA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:12.4.3:-:*:*:*:*:*:*",
"matchCriteriaId": "172F03B1-E693-4EF3-90A0-D40773E4ACB4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:13.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0F0B8E4F-ADE7-4594-9241-966B1F0BC440"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:grafana:grafana:13.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "2AD87DC5-DF20-4993-A11B-91EBB313A40A"
}
]
}
]
}
],
"references": [
{
"url": "https://grafana.com/security/security-advisories/cve-2026-28380",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}