CVE-2026-28374: IDOR in Annotations API allows unprivileged users to DELETE annotation
Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enforce proper authorization checks for DELETE operations in the Annotations API: verify the requesting user has explicit permission to delete the targeted annotation (e.g., is the annotation owner or has an administrative role). Do not permit users with the 'Editor' role to delete annotations they cannot read or create.
Annotations API DELETE authorization = deny for users without explicit delete/read access; require ownership or admin privilege - Compensating control
Until the authorization fix is deployed, restrict access to the Annotations DELETE endpoint (for example via network ACLs, firewall rules, or WAF policies) and enable logging/alerting for delete requests to detect and block unauthorized deletions.
- Operational
Audit recent annotation deletion logs to identify any unauthorized deletes, restore affected annotations from backups if available, and review roles/permissions for impacted users.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28374?
The severity of CVE-2026-28374 is medium with a score of 4.3.
What vulnerabilities are associated with CVE-2026-28374?
CVE-2026-28374 involves an Insecure Direct Object Reference (IDOR) in the Annotations API allowing unprivileged users to delete annotations.
How do I fix CVE-2026-28374?
To fix CVE-2026-28374, ensure that proper access controls are implemented to restrict deletion of annotations based on user permissions.
Who is affected by CVE-2026-28374?
CVE-2026-28374 affects users of Grafana who have editor privileges, allowing them to delete annotations without proper access.
What actions can be exploited in CVE-2026-28374?
The exploitation of CVE-2026-28374 allows unauthorized deletion of annotations by users lacking appropriate permissions.