CVE-2026-28380
- Source
- https://cve.org/CVERecord?id=CVE-2026-28380
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28380.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-28380
- Aliases
- Downstream
CGA (42)
- CGA-23rm-hgc4-26wp
- CGA-2cm4-vrp9-g68g
- CGA-2r88-5mfh-qh97
- CGA-2xfw-j6x5-h8qr
- CGA-3rqq-pjjg-p324
- CGA-3x4x-h6jx-f5hm
- CGA-4667-9h84-c626
- CGA-5gx2-2wwr-gjxf
- CGA-5xm9-v7mq-vmh4
- CGA-68qg-g273-49m7
- CGA-6q6m-2wvf-p965
- CGA-726f-p2gg-v4fh
- CGA-7pcm-f268-24p5
- CGA-7vx2-j5mv-wfmm
- CGA-88fx-v85v-3j23
- CGA-8j9h-m3rj-4g2g
- CGA-9792-hpm6-6c75
- CGA-9g78-37v3-47jw
- CGA-ccw4-96xv-v2h4
- CGA-crw2-5p2r-2p88
- CGA-ff24-rvmg-9qpf
- CGA-fp28-vmvx-37px
- CGA-g4xh-jr4r-5gxm
- CGA-h29g-r98c-5rc7
- CGA-hmcj-xm88-w74v
- CGA-hr69-6vh8-m3wf
- CGA-hv5g-fwxx-6wxv
- CGA-hw9g-4mpx-v6v9
- CGA-j86m-g64q-4g8c
- CGA-jrvj-43vq-fpfj
- CGA-m2pj-x69w-f9p9
- CGA-m63j-4c2q-7hqx
- CGA-m824-58mx-62f3
- CGA-mxph-hx97-j6gf
- CGA-pcq5-j6pr-x75p
- CGA-pq8c-pg7h-hmx5
- CGA-q54c-353x-v9cg
- CGA-q8f2-f56x-rmx4
- CGA-qjw9-37wv-68ch
- CGA-v892-8rgq-jxq6
- CGA-wqqr-j8r4-66xv
- CGA-xvrx-fw3r-m68p
CLSA (1)
MINI (16)
- MINI-2h26-q5mw-gw5p
- MINI-2w9x-549j-m563
- MINI-4fp8-r98q-7hg3
- MINI-533c-r296-5mf6
- MINI-5h84-mc2x-vxcj
- MINI-5ww9-x5p2-rwrq
- MINI-5x7h-5g5h-wvrr
- MINI-98c4-wg8w-955m
- MINI-c32h-2cw2-292c
- MINI-c9xg-x8g2-p755
- MINI-h2qw-vm5q-62vp
- MINI-m99c-6xm8-c368
- MINI-mxx8-gqr3-mp6m
- MINI-p3m2-rr69-m749
- MINI-wjhg-45g6-x35j
- MINI-x4p9-vg9h-qx45
openSUSE (2)
UBUNTU (1)
- Related
- Published
- 2026-05-13T19:28:32Z
- Modified
- 2026-10-28T02:30:46Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- BAC in Snapshot API allows deletion of unauthorized dashboard snapshots
- Details
-
Any Editor could delete any snapshot, even if they have no access to read or write them.
- Database specific
{ "cna_assigner": "GRAFANA", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28380.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "introduced": "9.4.0" }, { "last_affected": "11.6.14" }, { "introduced": "11.6.14" }, { "fixed": "11.6.14+security-04" }, { "introduced": "12.0.0" }, { "last_affected": "12.2.8" }, { "introduced": "12.2.8" }, { "fixed": "12.2.8+security-04" }, { "introduced": "12.3.0" }, { "last_affected": "12.3.6" }, { "introduced": "12.3.6" }, { "fixed": "12.3.6+security-04" }, { "introduced": "12.4.0" }, { "last_affected": "12.4.3" }, { "introduced": "12.4.3" }, { "fixed": "12.4.3+security-02" }, { "introduced": "13.0.0" }, { "last_affected": "13.0.1" }, { "introduced": "13.0.1" }, { "fixed": "13.0.1+security-01" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] } ] }- References
Affected packages
Git / github.com/grafana/grafana
Affected ranges
- Type
- GIT
- Repo
- https://github.com/grafana/grafana
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "range": [ { "introduced": "8.5.0" }, { "fixed": "11.6.14" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "range": [ { "introduced": "12.2.0" }, { "fixed": "12.2.8" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "range": [ { "introduced": "12.3.0" }, { "fixed": "12.3.6" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "range": [ { "introduced": "12.4.0" }, { "fixed": "12.4.3" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:grafana:grafana:11.6.14:-:*:*:*:*:*:*", "range": [ { "introduced": "11.6.14-NA" }, { "last_affected": "11.6.14-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:11.6.14:security01:*:*:*:*:*:*", "range": [ { "introduced": "11.6.14-security01" }, { "last_affected": "11.6.14-security01" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:12.2.8:-:*:*:*:*:*:*", "range": [ { "introduced": "12.2.8-NA" }, { "last_affected": "12.2.8-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:12.2.8:security01:*:*:*:*:*:*", "range": [ { "introduced": "12.2.8-security01" }, { "last_affected": "12.2.8-security01" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:12.3.6:-:*:*:*:*:*:*", "range": [ { "introduced": "12.3.6-NA" }, { "last_affected": "12.3.6-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:12.3.6:security01:*:*:*:*:*:*", "range": [ { "introduced": "12.3.6-security01" }, { "last_affected": "12.3.6-security01" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:12.4.3:-:*:*:*:*:*:*", "range": [ { "introduced": "12.4.3-NA" }, { "last_affected": "12.4.3-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:13.0.0:*:*:*:*:*:*:*", "range": [ { "introduced": "13.0.0" }, { "last_affected": "13.0.0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:13.0.1:-:*:*:*:*:*:*", "range": [ { "introduced": "13.0.1-NA" }, { "last_affected": "13.0.1-NA" } ], "source": "CPE_STRING" } ] }