Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-28374 EUVD-2026-30137GHSA-8mrj-8pc8-39jm

IDOR in Annotations API allows unprivileged users to DELETE annotation

Published May 13, 2026 · Updated Aug 27, 2026 · Assigned by GRAFANA

Vendor: Grafana Product: Grafana OSS Package: grafana Package: grafana-12.4 Category: Web / CMS Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.

Affected products

VendorProductAffectedFixed
Grafana Grafana OSS 8.5.0 – ≤ 11.6.14, 11.6.14 – < 11.6.14+security-04, 12.0.0 – ≤ 12.2.8, 12.2.8 – < 12.2.8+security-04, 12.3.0 – ≤ 12.3.6, 12.3.6 – < 12.3.6+security-04, 12.4.0 – ≤ 12.4.3, 12.4.3 – < 12.4.3+security-02, 13.0.0 – ≤ 13.0.1, 13.0.1 – < 13.0.1+security-01 11.6.14+security-04

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS grafana No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 grafana12.4 12.4.10-0.6.hum1 RHSA-2026:68821
Red Hat Hardened Images 1 grafana13.1 13.1.6-0.1.hum1 RHSA-2026:68767
Red Hat Hardened Images 1 grafana13.2 13.2.1-0.5.hum1 RHSA-2026:68778

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 grafana 12.4.5-150200.3.91.1 SUSE-SU-2026:3718-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Multi Linux Manager Tools SLE-Micro-5 dracut-saltboot 1.2.1-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-Micro-5 golang-github-prometheus-node_exporter 1.10.2-150002.3.6.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-Micro-5 uyuni-tools 5.2.12-150002.3.17.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 dracut-saltboot 1.2.1-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-QubitProducts-exporter_exporter 0.4.0-150002.3.6.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-boynux-squid_exporter 1.13.0-150002.3.6.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-lusitaniae-apache_exporter 1.0.10-150002.3.9.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-prometheus-alertmanager 0.28.1-150002.4.11.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-prometheus-node_exporter 1.10.2-150002.3.6.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-prometheus-prometheus 3.5.3-150002.3.13.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 grafana 11.6.14+security04-150002.4.21.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 mgr-push 5.2.4-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 prometheus-blackbox_exporter 0.26.0-150002.3.11.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 prometheus-postgres_exporter 0.10.1-150002.3.3.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 python-defusedxml-sle15 0.7.1-150002.1.3.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 rhnlib 5.2.5-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 spacecmd 5.2.8-150002.3.12.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 spacewalk-client-tools 5.2.6-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 supportutils-plugin-salt 1.2.3-150002.3.3.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 supportutils-plugin-susemanager-client 5.2.3-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 uyuni-common-libs 5.2.5-150002.3.6.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 uyuni-tools 5.2.12-150002.3.17.1 SUSE-SU-2026:2768-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-server-attestation-image +3 5.1.4-8.22.10 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-server-hub-xmlrpc-api-image +3 5.1.4-8.20.12 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-server-image +3 5.1.4-8.20.34 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-server-migration-14-16-image +3 5.1.4-8.20.13 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-server-postgresql-image +3 5.1.4-6.24.3 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-server-saline-image +3 5.1.4-9.20.24 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Server Extension for SLE 5.1 uyuni-tools 5.1.29-150700.3.26.1 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-proxy-httpd-image +3 5.1.4-8.22.22 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-proxy-salt-broker-image +3 5.1.4-9.20.25 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-proxy-squid-image +3 5.1.4-8.20.11 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-proxy-ssh-image +3 5.1.4-8.20.12 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 suse-multi-linux-manager-5.1-s390x-proxy-tftpd-image +3 5.1.4-8.20.13 SUSE-SU-2026:2774-1
SUSE Multi-Linux Manager Proxy Extension for SLE 5.1 uyuni-tools 5.1.29-150700.3.26.1 SUSE-SU-2026:2774-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed grafana 11.6.14+security04-1.1 openSUSE-SU-2026:10932-1
openSUSE Leap 16.0 grafana 11.6.14+security04-bp160.1.1 openSUSE-SU-2026:20940-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling grafana-12.4 12.4.3.02-r0 —

Advisories 9

References