CVE-2026-28374 describes an access control vulnerability in Grafana OSS where users with editor privileges can delete annotations regardless of their read permissions. Although editor users cannot create or read annotations, they can still delete any annotation, which indicates improper enforcement of authorization controls related to annotation deletion.

The vulnerability allows editor-level users to delete annotations they are not authorized to read, leading to unauthorized modification of data integrity. There is no impact on confidentiality or availability, and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary fix is indicated, users should monitor vendor communications for updates. In the meantime, consider restricting editor privileges or limiting annotation deletion permissions as a temporary mitigation.