SolarWinds Observability Self‑Hosted contains a broken authorization schema that allows users with minimal privileges to view and modify data beyond their allowed scope, which compromises the confidentiality and integrity of observability information.

The vulnerability applies to all releases of SolarWinds Observability Self‑Hosted prior to version 2026.4, and the vendor recommends upgrading to the 2026.4 build or later to obtain the fix.

The flaw has a CVSS score of 8.8, indicating high severity. EPSS data is not available and the issue is not listed in CISA KEV, implying no widespread public exploitation is known. Based on the description, it is inferred that an attacker must have an authenticated low‑privileged user account; internal actors or compromised credentials could leverage the flaw. No publicly reachable entry points are mentioned, so the attack vector is likely internal through legitimate use of the software.