---
id: "CVE-2026-28328"
kind: "vulnerability"
aliases: ["CVE-2026-28328"]
title: "SolarWinds Observability Self-Hosted: broken authorization lets low-privileged users change data"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "SolarWinds Observability Self-Hosted", "fixed": ["2026.4"], "affected": "<= 2026.2.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "observability", "self-hosted", "solarwinds"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-20T17:17:38+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-24T00:12:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28328", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:12:37+00:00"}]
---

# SolarWinds Observability Self-Hosted: broken authorization lets low-privileged users change data

SolarWinds Observability Self-Hosted 2026.2.3 and earlier has a broken authorization flaw (CWE-863): a low-privileged authenticated user can read and modify data beyond their permissions. CVSS 8.8. Fixed in 2026.4.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SolarWinds Observability Self-Hosted affected <= 2026.2.3 fixed 2026.4

## How to check

In the SolarWinds Platform web console, open Settings > All Settings > Product/Module Details (or the footer version) and read the Observability Self-Hosted version. 2026.2.3 or lower is affected. Exact menu path not verified.

## Fix

Upgrade SolarWinds Observability Self-Hosted to 2026.4 or later. Until then, limit who holds low-privileged accounts and review their activity.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-28328
- 2026-10-24T00:12:37+00:00 analyst — Read SolarWinds advisory (primary): affected <=2026.2.3, fixed 2026.4, CVSS 8.8, credit NATO researchers. No PoC or exploitation reported (search only; KEV not checked directly). Did not search X/HN.

## Documents

- [advisory] SolarWinds advisory CVE-2026-28328 https://solarwinds.com/trust-center/security-advisories/CVE-2026-28328

## From the sources

SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_