{"id":"CVE-2026-28328","published":"2026-10-20T17:17:38.910","lastModified":"2026-10-21T04:18:10.420","description":"SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm","tags":[]},{"url":"https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-4_release_notes.htm","tags":[]},{"url":"https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28328","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"SolarWinds Observability Self-Hosted has a broken authorization schema allowing low-privileged users to access and modify data beyond their permissions due to insufficient access control enforcement.","exploitability":"Exploitation requires valid low-privileged credentials and knowledge of protected endpoints; no public exploit exists, but the vulnerability is straightforward for authenticated attackers.","blast_radius":"An attacker could read sensitive data, alter configurations, or disrupt operations across the platform, potentially compromising confidentiality, integrity, and availability.","remediation":"Upgrade to SolarWinds Observability Self-Hosted version 2.590 or later, which includes the vendor's fix for this authorization flaw.","detection":"Monitor for anomalous API calls from low-privileged users to administrative endpoints (e.g., /api/v2/admin/*, /settings/*) with elevated privilege patterns in access logs; look for unexpected writes to sensitive configuration resources.","tags":["auth-bypass","privilege-escalation","web","solarwinds"],"model":"garnet-coder","analyzedAt":"2026-10-26T09:02:29.629Z"}}