This vulnerability in Grafana OSS allows users with editor privileges to delete annotations regardless of their read access permissions. While editors cannot create or read annotations, the improper permission enforcement enables them to remove annotations they should not be able to manage. Affected versions include a range from 8.5.0 through 13.0.1. The CVSS v3.1 base score is 4.3, indicating medium severity with impact limited to integrity (deletion of annotations) but no confidentiality or availability impact. No official remediation or patch information is currently available.

The vulnerability impacts the integrity of annotation data in Grafana OSS by allowing editor users to delete annotations without proper read permissions. This could lead to unauthorized removal of annotations, potentially affecting data accuracy or audit trails. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should review and possibly restrict editor user permissions to minimize risk. Monitoring user actions related to annotations may help detect misuse.