CVE-2026-28328: CWE-863: Incorrect Authorization in SolarWinds SolarWinds Observability Self-Hosted

CVE-2026-28328 describes an incorrect authorization vulnerability in SolarWinds Observability Self-Hosted. The broken authorization schema permits users with low privileges to access and modify information that should be restricted, violating access control policies. This can result in unauthorized data exposure and manipulation. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits have been reported in the wild.

Exploitation of this vulnerability allows low-privileged users to bypass intended access controls, potentially leading to unauthorized disclosure, modification, or deletion of sensitive information within SolarWinds Observability Self-Hosted. This can compromise the security posture of affected environments by elevating user privileges beyond their assigned roles.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious activity related to privilege escalation attempts.