CVE-2026-28380 BAC in Snapshot API allows deletion of unauthorized dashboard snapshots
An Editor can delete any dashboard snapshot regardless of access rights, allowing unauthorized data modification in Grafana OSS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-28380?
CVE-2026-28380 is a medium-severity missing authorization vulnerability in Grafana Grafana, published on 13 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Any Editor could delete any snapshot, even if they have no access to read or write them.
Weakness: CWE-862
Which versions are affected by CVE-2026-28380?
1 open source package ship an affected version, including grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | From 9.4.0 | 11.6.14, 12.2.8, 12.3.6, 12.4.3, 13.0.1 |
Products include Grafana Grafana.
How do I fix CVE-2026-28380?
Upgrade grafana to a fixed version for your release line: 11.6.14, 12.2.8, 12.3.6 or 12.4.3.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-28380 being exploited?
There is no known exploitation of CVE-2026-28380 in the wild and no public exploit code.
Other vulnerabilities in Grafana Grafana
Sources
Also known as BIT-grafana-2026-28380, GHSA-29p4-5443-x453, MINI-2h26-q5mw-gw5p, MINI-2w9x-549j-m563, MINI-4fp8-r98q-7hg3, MINI-533c-r296-5mf6 and 13 more.