{"id":"CVE-2026-28328","kind":"vulnerability","aliases":["CVE-2026-28328"],"related":[],"title":"SolarWinds Observability Self-Hosted: broken authorization lets low-privileged users change data","description":"SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.","summary":"SolarWinds Observability Self-Hosted 2026.2.3 and earlier has a broken authorization flaw (CWE-863): a low-privileged authenticated user can read and modify data beyond their permissions. CVSS 8.8. Fixed in 2026.4.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SolarWinds Observability Self-Hosted","fixed":["2026.4"],"affected":"<= 2026.2.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","observability","self-hosted","solarwinds"],"not_affected_if":["managed-hosting"],"how_to_check":"In the SolarWinds Platform web console, open Settings > All Settings > Product/Module Details (or the footer version) and read the Observability Self-Hosted version. 2026.2.3 or lower is affected. Exact menu path not verified.","fix":"Upgrade SolarWinds Observability Self-Hosted to 2026.4 or later. Until then, limit who holds low-privileged accounts and review their activity.","status":"open","published_at":"2026-10-20T17:17:38+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:32:49+00:00","updated_at":"2026-10-24T00:12:37+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:32:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SolarWinds Observability Self-Hosted: broken authorization lets low-privileged users change data","impact":"medium","summary":"SolarWinds Observability Self-Hosted has an authorization flaw that lets low-privileged accounts read and modify information beyond their assigned permissions. An attacker with a basic user account can reach data and settings that should be restricted to admins.","category":"infrastructure","who_cares":["solarwinds","self-hosted","observability"],"confidence":0.6,"needs_auth":"yes","worst_case":"low-privileged user reads and modifies data beyond their permissions","analyst_note":"Find the fixed version and affected range in the SolarWinds advisory for CVE-2026-28328; the NVD entry alone gives no version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000461,"input_tokens":2867,"output_tokens":348,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version and affected range in the SolarWinds advisory for CVE-2026-28328; the NVD entry alone gives no version.","search":"'-2026':16A,19A '-28328':17A,20A '-863':46B '2026.2.3':37B '2026.4':65B '8.8':62B 'access':89C 'affect':75C 'allow':83C 'assign':95C 'authent':51B 'author':7A,43B,79C 'beyond':58B,93C 'broken':6A,42B,78C 'chang':13A 'cve':15A,18A 'cvss':61B 'cwe':45B 'data':14A,57B 'earlier':39B 'fix':63B 'flaw':44B 'found':72C 'host':5A,30B,36B,70C 'hosted':25A 'inform':92C 'infrastructur':26B 'let':8A 'low':10A,49B,85C 'low-privileg':9A,48B,84C 'modifi':56B,91C 'observ':2A,27B,33B,67C 'observability':22A 'permiss':60B,96C 'privileg':11A,50B,86C 'read':54B 'schema':80C 'self':4A,24A,29B,35B,69C 'self-host':3A,28B,34B,68C 'self-hosted':23A 'solarwind':1A,31B,32B,66C 'solarwinds':21A 'user':12A,52B,87C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T17:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@solarwinds.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-28328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28328","severity":null,"published_at":"2026-10-20T17:17:38+00:00","modified_at":"2026-10-21T04:18:10+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-28328:610","url":null,"severity":null,"published_at":"2026-10-24T00:12:37+00:00","modified_at":"2026-10-24T00:12:37+00:00","first_seen_at":"2026-10-24T00:12:37+00:00","fetched_at":"2026-10-24T00:12:37+00:00","note":"Read SolarWinds advisory (primary): affected <=2026.2.3, fixed 2026.4, CVSS 8.8, credit NATO researchers. No PoC or exploitation reported (search only; KEV not checked directly). Did not search X/HN."}],"documents":[{"id":2477,"url":"https://solarwinds.com/trust-center/security-advisories/CVE-2026-28328","title":"SolarWinds advisory CVE-2026-28328","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}