Description
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.
Published: 2026-07-07
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The public dashboard deletion endpoint in Grafana fails to enforce organization isolation. An administrator with Org Admin privileges can send a request that specifies dashboard identifiers from another organization, which causes those dashboards to be deleted. This results in unauthorized removal of data and loss of functionality; the flaw is an improper access control weakness, identified as CWE-284.

Affected Systems

This vulnerability affects all Grafana Enterprise and Grafana OSS instances, regardless of version, because no specific affected version information is provided. Any instance that exposes the public dashboard deletion endpoint is vulnerable.

Risk and Exploitability

The CVSS score of 3.1 classifies the vulnerability as low severity. The EPSS score is in the (< 1%) interval, indicating a very low probability of exploitation. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector requires an internal Org Admin who can send crafted requests to the deletion endpoint, and it is limited to environments where such users have network access to the Grafana instance and the public deletion API is exposed.

Generated by OpenCVE AI on July 25, 2026 at 20:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Grafana to the latest stable release once an official fix is published.
  • Until a patch is available, restrict the public deletion API so that only internal administrators can execute it; use network controls or role‑based access to limit exposure.
  • Continuously monitor audit logs for cross‑organization deletion attempts, ensuring that the organization initiating the deletion matches the organization of the target dashboard; if a mismatch occurs, reject the request.

Generated by OpenCVE AI on July 25, 2026 at 20:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 20 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1220
References
Metrics threat_severity

None

 threat_severity

Low

Mon, 13 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Grafana
Grafana grafana
Grafana grafana Enterprise
Vendors & Products Grafana
Grafana grafana
Grafana grafana Enterprise

Thu, 09 Jul 2026 04:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 08 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-639

Wed, 08 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 04:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-639

Tue, 07 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.
Title Cross-Organization Public Dashboard Deletion via Missing Org Isolation
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Grafana Grafana Grafana Enterprise
cve-icon MITRE

Status: PUBLISHED

Assigner: GRAFANA

Published:

Updated: 2026-07-24T12:23:16.179Z

Reserved: 2026-02-27T07:16:12.218Z

Link: CVE-2026-28378

cve-icon Vulnrichment

Updated: 2026-07-08T13:52:44.839Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-07T21:08:04Z

Links: CVE-2026-28378 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-25T21:00:14Z

Weaknesses
  • CWE-1220

    Insufficient Granularity of Access Control

  • CWE-284

    Improper Access Control