CVE-2026-28380 is a privilege mismanagement vulnerability in Grafana OSS where users assigned the Editor role can delete any snapshot, even if they lack explicit read or write permissions for those snapshots. This flaw corresponds to CWE-862 (Missing Authorization). The vulnerability affects multiple explicitly listed versions of Grafana OSS, including 9.4.0, 11.6.14, 12.0.0, 12.2.8, 12.3.0, 12.3.6, 12.4.0, 12.4.3, 13.0.0, and 13.0.1. The CVSS v3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges as low (Editor), no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor has not published any patch or official remediation details as of the publication date.

An attacker or user with Editor privileges can delete snapshots they should not have access to, potentially leading to unauthorized data modification or loss of important snapshot data. There is no confidentiality or availability impact reported. The integrity impact is high due to unauthorized deletion capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Editor role assignments to trusted users only and monitor for unauthorized snapshot deletions.