CVE-2026-28378

[CVE catalog]

A flaw in Grafana's public dashboard deletion endpoint lacks organization isolation, allowing an Organization Administrator to delete public dashboards in other organizations using the target dashboard's ID. grafana: Grafana: Unauthorized public dashboard deletion across organizations This Low impact flaw in Grafana allows an authenticated Organization Administrator to delete public dashboards belonging to other organizations. This is due to insufficient isolation enforcement in the public dashboard deletion endpoint, potentially affecting the availability of dashboards in multi-organizational Grafana deployments. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

Low · CVSS 3.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Published

Jul 7, 2026, 9:08:04 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.23% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "grafana",
      "fixed_version": "",
      "applicability_unknown": true
    }
  ]
}