CVE-2026-28378 — Cross-Organization Public Dashboard Deletion via Missing Org Isolation

Description (CNA)

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.

Affected (CNA)

Vendor / product	Versions
Grafana / Grafana Enterprise	affected 11.6.0 through 11.6.13; affected 12.1.0 through 12.1.9; affected 12.2.0 through 12.2.7; affected 12.3.0 through 12.3.5; affected 12.4.0 through 12.4.1
Grafana / Grafana OSS	affected 11.6.0 through 11.6.13; affected 12.1.0 through 12.1.9; affected 12.2.0 through 12.2.7; affected 12.3.0 through 12.3.5; affected 12.4.0 through 12.4.1

CWE

No CWE identifiers supplied.

References

https://grafana.com/security/security-advisories/cve-2026-28378

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.