Security readout for executives and security teams
Plain-English summary
Authenticated Grafana Editors could delete annotations they were not permitted to view. This can erase dashboard context, incident notes, or operational records, but the supplied evidence indicates no data disclosure, privilege escalation, or service outage.
Executive priority
Treat this as a normal-priority integrity issue, accelerated where annotations support incident response, compliance, or operational decisions. Prioritize internet-accessible deployments and environments with broadly assigned Editor accounts. The supplied evidence does not justify emergency critical-incident handling.
Technical view
Grafana OSS has an authorization flaw in its Annotations API. A network-accessible user with low privileges and the Editor role can delete annotations outside their permitted read scope. The reported impact is limited to integrity, with CVSS 3.1 score 4.3 and CWE-284.
Likely exposure
Exposure applies to Grafana OSS deployments running the specifically listed versions and granting Editor access to potentially untrusted users. The source bundle marks other versions unaffected by default, but administrators should confirm precise release applicability with Grafana's advisory.
Exploitation context
The action requires an authenticated, low-privileged account and no user interaction. The bundle does not identify public exploitation or active attacks, and the CVE is not marked as included in KEV. Absence from KEV does not prove exploitation has never occurred.
Researcher notes
The authorization failure permits deletion without corresponding read or creation access, indicating inconsistent object-level permission enforcement. The supplied bundle names affected releases but does not state fixed versions, patch details, logging coverage, or observed exploitation. Consult the vendor advisory for current remediation specifics.
Mitigation direction
- Review Grafana's advisory and apply the vendor-recommended fixed release or mitigation.
- Inventory Grafana OSS instances and compare their exact releases with the listed affected versions.
- Remove unnecessary Editor access and apply least privilege while remediation is pending.
- Preserve relevant audit and application logs before remediation for retrospective review.
Validation and detection
- Confirm every Grafana OSS instance's exact version and assigned Editor accounts.
- Verify remediated instances follow the release guidance in Grafana's advisory.
- Review available logs for unexpected annotation deletions by Editor accounts.
- Test authorization boundaries in an approved non-production environment without deleting production data.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-28374 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N2.81.4GRAFANAVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://grafana.com/security/security-advisories/cve-2026-28374CVE reference, GRAFANA · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.