Executive brief
Grafana is a popular data visualization and monitoring platform. A security flaw in its annotation system allows users with 'Editor' permissions to delete any dashboard annotation, including those they are not authorized to view or modify. This could lead to the loss of important historical notes or operational context within monitoring dashboards.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists within the Grafana Annotations API. The root cause is improper access control (CWE-284) where the application fails to validate if the requesting user has sufficient permissions to delete a specific annotation object. An authenticated attacker with 'Editor' privileges can send a network request to the API to delete arbitrary annotations, even if they lack read or create permissions for those specific entries. The vulnerability is resolved in versions 11.6.14, 12.2.8, 12.3.6, 12.4.3, and 13.0.1 (and their respective security patches).
Affected products
- Grafana Labs Grafana 8.5.0 to 11.6.13, 12.2.0 to 12.2.7, 12.3.0 to 12.3.5, 12.4.0 to 12.4.2, 13.0.0
Timeline
- 2026-05-13: disclosed
- 2026-05-13: advisory
- 2026-05-13: patched