A flaw in the Annotations API allowed editor users to delete any annotation regardless of the lack of read permissions. This IDOR vulnerability enables an attacker who is authenticated as an editor to remove annotations that they should not have visibility into, compromising data integrity and potentially erasing critical contextual information.

The affected product is Grafana OSS. Specific versions are not listed in the advisory, so all currently deployed instances of Grafana OSS remain potentially vulnerable until verified patching.

The CVSS score of 4.3 places the issue in the low to moderate range, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to authenticate as an editor and then exploit the DELETE API endpoint; no remote unauthenticated exploit is described. The absence of exploit data suggests a lower likelihood, but the confidentiality impact is limited because a reader is not granted deletion rights, and the attackers cannot read hidden annotations. Nonetheless, the data loss angle warrants attention.