CVE-2026-28380: BAC in Snapshot API allows deletion of unauthorized dashboard snapshots
Any Editor could delete any snapshot, even if they have no access to read or write them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the Snapshot API authorization checks so that deleting a snapshot is only allowed for the snapshot owner or for users with explicit read/write or admin permissions; ensure the Editor role cannot delete snapshots it does not have read or write access to.
Snapshot API snapshot_deletion_authorization = require ownership or explicit read/write or admin permission - Compensating control
Restrict access to the Snapshot API delete endpoint (for example via firewall, WAF, API gateway access controls, or network ACLs) to trusted administrators/service accounts, or temporarily disable snapshot deletion until authorization is fixed.
- Operational
Audit recent snapshot deletion events to identify unauthorized deletions, restore affected snapshots from backups if available, and notify impacted users; review and adjust Editor-role permissions to remove inappropriate deletion capability.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28380?
CVE-2026-28380 has been classified as a medium severity vulnerability.
How do I fix CVE-2026-28380?
To fix CVE-2026-28380, you should update Grafana to the latest version where the vulnerability is patched.
What impact does CVE-2026-28380 have on my Grafana deployment?
CVE-2026-28380 allows unauthorized deletion of dashboard snapshots, which can lead to data loss.
Who is affected by CVE-2026-28380?
Any Grafana deployment that allows Editor roles can be affected by CVE-2026-28380.
Can I mitigate CVE-2026-28380 without upgrading Grafana?
Temporary mitigation could involve restricting Editor permissions, but upgrading is the recommended solution.