The vulnerability stems from Grafana’s RBAC service ignoring the requested folder when verifying if a user is a folder administrator for deleted dashboard listings. Because of this, a user with dashboard permission‑management rights on any folder can be treated as an administrator of every folder. This flaw can result in the disclosure of deleted dashboards from folders where the user does not actually have administrative access, potentially exposing sensitive configuration or historical data. The weakness is a missing authorization check (CWE‑862).

Affected systems include Grafana Enterprise and Grafana OSS deployments. No specific version information is supplied in the advisory, so any installation using the impacted RBAC component should be evaluated. The advisory references Grafana’s support site for details.

The CVSS score for this issue is 6.5, indicating a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require an authenticated user with the capability to manage dashboard permissions on at least one folder; no separate exploit code or remote code execution path is described. This suggests that the risk is tied to privilege escalation and data exposure within authorized users rather than external attackers.