CVE-2026-28374 is an access control vulnerability in Grafana OSS where users with editor privileges can delete any annotation regardless of their read permissions. This flaw violates intended access restrictions by permitting deletion of annotations that editors cannot otherwise read or create. The vulnerability is identified as CWE-284 (Improper Access Control) and affects several specific versions of Grafana OSS. No official remediation or patch has been indicated in the available data.

The vulnerability allows editor-level users to delete annotations they should not have access to, potentially leading to unauthorized modification of annotation data. There is no impact on confidentiality or availability reported, and the vulnerability does not allow creation or reading of restricted annotations by the editor user.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, users should monitor vendor communications for updates. Until a fix is available, consider restricting editor privileges or limiting annotation deletion capabilities as a temporary control.