CVE-2026-28378

Fixed in a distro release EPSS <1%CVSS 3.1

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.

Published 2026-07-07 · CVE record · OSV

Products: Grafana Enterprise, Grafana OSS

Distro releases