CVEFinder.io

CVE-2026-28380

đŸ”ļ medium
Summary

Any Editor could delete any snapshot, even if they have no access to read or write them.

CVSS Score
6.5
Medium
EPSS Score
0.0
Exploit Probability
Published Date
2026-05-13
First Seen: 2026-05-17
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 46.6% of all 365,890 vulnerabilities in our database.

#195,497
Below average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: May 14, 2026
🔍 Exploitation Status
None
No known exploits
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-06-02
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE IDs (Weakness Types)
CWE-862

đŸ“Ļ Affected Products 10

Vendor Product Status Affected Versions
grafana grafana Affected
> 8.5.0 < 11.6.14
grafana grafana Affected
> 12.2.0 < 12.2.8
grafana grafana Affected
> 12.3.0 < 12.3.6
grafana grafana Affected
> 12.4.0 < 12.4.3
grafana grafana Affected
v11.6.14
grafana grafana Affected
v12.2.8
grafana grafana Affected
v12.3.6
grafana grafana Affected
v12.4.3
grafana grafana Affected
v13.0.0
grafana grafana Affected
v13.0.1

🔗 References 1

https://grafana.com/security/security-advisories/cve...
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-14199 ⚠ī¸ high 7.1 0.3 Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than z... 2026-09-02
CVE-2026-33382 ⚠ī¸ high 7.5 0.4 Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing... 2026-07-10
CVE-2026-8595 đŸ”ļ medium 6.8 0.2 A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that ex... 2026-07-10
CVE-2026-8609 đŸ”ļ medium 5.3 0.4 An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory... 2026-07-10
CVE-2026-28378 ℹī¸ low 3.1 0.1 The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organizatio... 2026-07-07
CVE-2026-10601 đŸ”ļ medium 5.4 0.3 A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach uni... 2026-06-22
These CVEs affect the same products