A flaw in the Annotations API allowed editor users to delete any annotation regardless of read permissions. This IDOR vulnerability stems from improper authorization (CWE-1220), improper access control (CWE-284). Attackers who authenticate as editors can remove annotations that they should not see, compromising data integrity and erasing contextual information.

The affected product is Grafana OSS. Specific versions are not listed in the advisory, so all currently deployed instances of Grafana OSS remain potentially vulnerable until verified patching.

The CVSS score of 4.3 places the issue in the low to moderate range, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to authenticate as an editor and then exploit the DELETE API endpoint; no remote unauthenticated exploit is described. The absence of exploit data suggests a lower likelihood, but the confidentiality impact is limited because a reader is not granted deletion rights, and the attackers cannot read hidden annotations. Nonetheless, the data loss angle warrants attention.