SolarWinds Observability Self-Hosted broken authorization schema (CVE-2026-28328)

Summary

SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.

Affected Products

SolarWinds Observability Self-Hosted 2026.2.3 and below

Fixed Software Release

SolarWinds Observability Self-Hosted 2026.4

Acknowledgments

Dimitrios Titos from NATO Cyber Security Centre (NCSC)

Georgios Sotiriadis from NATO Cyber Security Centre (NCSC)