CVE-2026-28378: Grafana incorrect access control in public dashboard deletion

CVE-2026-28378 · Severity: low · CVSS 3.1 · Published 2026-07-07

Grafana, a popular data visualization and monitoring platform, contains a security flaw in how it handles public dashboards. An administrator of one organization can delete public dashboards belonging to a completely different organization on the same server. While this does not expose private data, it can lead to the unauthorized removal of shared monitoring views and disrupt operations for other teams.

Technologies: Grafana Labs Grafana Enterprise, Grafana Labs Grafana OSS. Vendors: Grafana Labs.

Quick answers

Is CVE-2026-28378 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-28378 being exploited in the wild.
How severe is CVE-2026-28378?
Low severity, with a CVSS score of 3.1, published 7 July 2026.
Which products and versions are affected?
Grafana Labs Grafana Enterprise 11.6.0 - 11.6.13, 12.1.0 - 12.1.9, 12.2.0 - 12.2.7, 12.3.0 - 12.3.5, 12.4.0 - 12.4.1; Grafana Labs Grafana OSS 11.6.0 - 11.6.13, 12.1.0 - 12.1.9, 12.2.0 - 12.2.7, 12.3.0 - 12.3.5, 12.4.0 - 12.4.1.
Is there a fix for CVE-2026-28378?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-28378 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-28378?
Check whether you run Grafana Labs Grafana Enterprise or Grafana Labs Grafana OSS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Broken Access Control vulnerability exists in the public dashboard deletion endpoint of Grafana. The root cause is a failure to enforce organization isolation (multi-tenancy boundaries) during the deletion process. An attacker with 'Org Admin' privileges in one organization can send a crafted request to the deletion endpoint containing the identifiers of a dashboard belonging to a different organization. This allows for unauthorized deletion of public dashboards across organizational boundaries. The attack requires network access and valid low-level administrative credentials (Org Admin), but no user interaction from the victim.

Affected products

  • Grafana Grafana Enterprise 11.6.0 - 11.6.13, 12.1.0 - 12.1.9, 12.2.0 - 12.2.7, 12.3.0 - 12.3.5, 12.4.0 - 12.4.1
  • Grafana Grafana OSS 11.6.0 - 11.6.13, 12.1.0 - 12.1.9, 12.2.0 - 12.2.7, 12.3.0 - 12.3.5, 12.4.0 - 12.4.1

Timeline

  • 2026-07-07: advisory
  • 2026-07-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.