{"id":"CVE-2026-28328","title":"SolarWinds Observability Self-Hosted broken authorization schema","summary":"SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-863"],"vendor":"SolarWinds","product":"SolarWinds Observability Self-Hosted","affected":["observability_self-hosted 2026.2.3 and all previous versions"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-20T18:18:04.697460Z"},"published":"2026-10-20","updated":"2026-10-21","sourceUpdated":"2026-10-21T03:56:28.456Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-28328","references":[{"url":"https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-4_release_notes.htm"},{"url":"https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28328"},{"url":"https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T17:12:53.604Z","slug":"CVE-2026-28328","body":"## Overview\n\nSolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.\n\n## Affected\n\n- `observability_self-hosted 2026.2.3 and all previous versions`\n\n## Remediation\n\nSolarWinds recommends customers to upgrade to Observability Self-Hosted version 2026.4 as soon as is practical.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}