low3.1
CVE-2026-28378
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging…
Impact
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Grafana | Grafana | from 11.6.0 through 11.6.13 from 12.1.0 through 12.1.9 from 12.2.0 through 12.2.7 from 12.3.0 through 12.3.5 Version 12.4.0 |