CVE-2026-28380 is an authorization vulnerability in Grafana OSS where users assigned the Editor role can delete snapshots without having explicit read or write permissions on those snapshots. This flaw violates intended access controls, potentially allowing unauthorized modification of snapshot data. The vulnerability is classified under CWE-862 (Improper Authorization) and affects multiple specific versions of Grafana OSS. There is no vendor advisory or patch available at this time, and no known exploits have been reported in the wild.

The vulnerability allows users with Editor privileges to delete snapshots they should not have access to, leading to unauthorized modification of snapshot data. This could disrupt monitoring or reporting workflows that rely on these snapshots, but does not impact confidentiality or availability directly. The CVSS score of 6.5 reflects a medium severity due to the integrity impact without confidentiality or availability loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should carefully review and restrict Editor role assignments to trusted users only to minimize risk. Monitor for vendor updates regarding patches or official mitigations.