Security readout for executives and security teams
Plain-English summary
A Grafana OSS authorization flaw allows any user with the Editor role to delete dashboard snapshots they are not permitted to access. The primary business risk is unauthorized loss or alteration of shared dashboard snapshot records; the supplied scoring indicates no direct confidentiality or availability impact.
Executive priority
Schedule prompt remediation through normal vulnerability-management processes. Accelerate if dashboard snapshots support operational, compliance, customer, or incident-response decisions, or if Editor access is broadly assigned. This is a meaningful integrity risk, but the supplied evidence does not justify emergency critical-incident treatment.
Technical view
CVE-2026-28380 is a missing-authorization vulnerability (CWE-862) in the Snapshot API. A network-accessible, low-privileged Editor can delete snapshots without read or write authorization. CVSS 3.1 is 6.5: low complexity, no user interaction, unchanged scope, high integrity impact, and no scored confidentiality or availability impact.
Likely exposure
Exposure exists where Grafana OSS runs an enumerated affected version and users hold Editor privileges. The bundle lists versions from 9.4.0 through 13.0.1 as specific entries; it does not establish broader version ranges. Anonymous or non-Editor exploitation is not supported by the supplied evidence.
Exploitation context
The action is remotely reachable according to the CVSS vector, but requires an authenticated low-privilege Editor account. Exploitation would permit unauthorized snapshot deletion. The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or public weaponization.
Researcher notes
The authorization boundary should be evaluated at the Snapshot API deletion operation, particularly object-level permission enforcement for Editor users. Validate only in an authorized test environment. The supplied bundle does not identify the vulnerable implementation, fixed versions, logging coverage, exploit availability, or affected version ranges beyond the enumerated releases.
Mitigation direction
- Compare every Grafana OSS deployment against the specifically listed affected versions.
- Consult Grafana's advisory for vendor-approved corrected releases or mitigation guidance.
- Upgrade affected deployments to a vendor-designated non-affected release after testing.
- Remove unnecessary Editor privileges while remediation is pending.
- Preserve relevant records and investigate unexpected snapshot deletions.
Validation and detection
- Inventory Grafana OSS versions and document all matches against the supplied affected-version list.
- Review Editor-role assignments and remove access that is no longer operationally required.
- After remediation, verify Editors cannot delete snapshots outside their authorized scope.
- Review available access or audit records for unexplained Snapshot API deletion activity.
- Confirm deployed versions and controls against Grafana's current advisory.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-28380 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N2.83.6GRAFANAVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://grafana.com/security/security-advisories/cve-2026-28380CVE reference, GRAFANA · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.