CVE-2026-28380 is a medium severity vulnerability in Grafana OSS where users assigned the Editor role can delete any snapshot, even if they lack explicit permissions to read or write those snapshots. This issue affects a range of Grafana OSS versions from 9.4.0 through 13.0.1. The vulnerability impacts data integrity by allowing unauthorized deletion of snapshots. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges of level 'L' (low), no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or official remediation level has been disclosed by the vendor as of the published date.

The vulnerability allows unauthorized deletion of snapshot data by users with Editor privileges, compromising data integrity. There is no impact on confidentiality or availability. This could disrupt workflows or cause loss of important snapshot information within affected Grafana OSS instances.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should review and potentially restrict Editor role assignments to trusted users only to minimize risk. Monitor vendor communications for updates on patches or mitigations.