CVE-2026-28378

Cross-Organization Public Dashboard Deletion via Missing Org Isolation

State: Published
Severity: 3.1 Low
Published: Jul 7, 2026
Updated: Aug 27, 2026
Reserved: Feb 27, 2026

Description

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.

Scores

CVSS	Score	Vector	Source
3.1	3.1 Low	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N	GRAFANA

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
Grafana EnterpriseGrafana	11.6.0 through 11.6.13Affected 12.1.0 through 12.1.9Affected 12.2.0 through 12.2.7Affected 12.3.0 through 12.3.5Affected 12.4.0 through 12.4.1Affected
Grafana OSSGrafana	11.6.0 through 11.6.13Affected 12.1.0 through 12.1.9Affected 12.2.0 through 12.2.7Affected 12.3.0 through 12.3.5Affected 12.4.0 through 12.4.1Affected

References

https://grafana.com/security/security-advisories/cve-2026-28378vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.