Security readout for executives and security teams
Plain-English summary
Grafana has a flaw where any user with the Editor role can delete dashboard snapshots they should not be allowed to touch, including snapshots owned by other users. There is no data theft or system takeover, but it lets low-privileged insiders erase saved visual reports, which can disrupt reporting workflows and destroy evidence used for operations or investigations.
Executive priority
Moderate priority. This is not an emergency, but any organization running Grafana OSS with multiple Editor-level users should schedule the vendor-recommended upgrade in the next standard patch cycle to protect reporting integrity.
Technical view
CVE-2026-28380 is a broken access control issue (CWE-862, Missing Authorization) in Grafana OSS Snapshot API. The endpoint fails to verify that the requesting Editor actually owns or has read/write access to the target snapshot before performing deletion. CVSS 3.1 is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), reflecting authenticated network access with high integrity impact and no confidentiality or availability loss.
Likely exposure
Any Grafana OSS deployment on the listed versions where users hold the Editor role and the Snapshot feature is enabled. Multi-tenant, shared, or SaaS-style Grafana instances with many editors face the greatest exposure.
Exploitation context
Not listed in CISA KEV and no public exploitation reported in the cited sources. Exploitation requires a valid authenticated account with Editor role, so the risk is primarily insider misuse or a compromised Editor credential rather than unauthenticated internet attack.
Researcher notes
CWE-862 in the Snapshot API DELETE path, scored 6.5 with integrity-only impact. Vendor advisory is the authoritative source for exact fixed versions across the listed 9.4.0 through 13.0.1 range. No PoC, KEV entry, or in-the-wild exploitation is cited. Confidentiality and availability are marked None, so treat this as a data-integrity and audit-trail concern rather than a takeover risk.
Mitigation direction
- Review Grafana's advisory and upgrade OSS to a fixed release per vendor guidance.
- Audit Editor role assignments and remove Editors who do not need snapshot access.
- Restrict the Snapshot API at the reverse proxy if patching is delayed.
- Back up dashboard snapshots so accidental or malicious deletion is recoverable.
- Enable Grafana audit logging to capture snapshot deletion events.
Validation and detection
- Identify Grafana version via /api/health or admin UI and compare to affected list.
- Confirm which accounts hold the Editor role across all organizations.
- Review Grafana audit logs for unexpected snapshot delete API calls.
- Verify the vendor-recommended fixed version is deployed after upgrade.
- Test snapshot deletion with a non-owner Editor account in a lab to confirm the fix.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-28380 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N2.83.6GRAFANAVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://grafana.com/security/security-advisories/cve-2026-28380CVE reference, GRAFANA · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.