CVE-2026-28374
IDOR in Annotations API allows unprivileged users to DELETE annotation
Medium · published May 13, 2026
What it is
Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.
The record
Technical detail
- CVSS v3.1
- 4.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00198 · 9.1th percentile
- Published
- 2026-05-13T19:28Z
EPSS history
Timeline