Skip to content
CVE PROGRAM SOURCE RECORD3.1 Low

CVE-2026-28378

Cross-Organization Public Dashboard Deletion via Missing Org Isolation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Grafana Enterprise

Default version status: unaffected

  • 11.6.0 to ≤ 11.6.13affected
  • 12.1.0 to ≤ 12.1.9affected
  • 12.2.0 to ≤ 12.2.7affected
  • 12.3.0 to ≤ 12.3.5affected
  • 12.4.0 to ≤ 12.4.1affected

Grafana Grafana OSS

Default version status: unaffected

  • 11.6.0 to ≤ 11.6.13affected
  • 12.1.0 to ≤ 12.1.9affected
  • 12.2.0 to ≤ 12.2.7affected
  • 12.3.0 to ≤ 12.3.5affected
  • 12.4.0 to ≤ 12.4.1affected

References