Executive brief
Grafana, a popular data visualization and monitoring platform, contains a security flaw in how it handles public dashboards. An administrator of one organization can delete public dashboards belonging to a completely different organization on the same server. While this does not expose private data, it can lead to the unauthorized removal of shared monitoring views and disrupt operations for other teams.
Technical details
A Broken Access Control vulnerability exists in the public dashboard deletion endpoint of Grafana. The root cause is a failure to enforce organization isolation (multi-tenancy boundaries) during the deletion process. An attacker with 'Org Admin' privileges in one organization can send a crafted request to the deletion endpoint containing the identifiers of a dashboard belonging to a different organization. This allows for unauthorized deletion of public dashboards across organizational boundaries. The attack requires network access and valid low-level administrative credentials (Org Admin), but no user interaction from the victim.
Affected products
- Grafana Grafana Enterprise 11.6.0 - 11.6.13, 12.1.0 - 12.1.9, 12.2.0 - 12.2.7, 12.3.0 - 12.3.5, 12.4.0 - 12.4.1
- Grafana Grafana OSS 11.6.0 - 11.6.13, 12.1.0 - 12.1.9, 12.2.0 - 12.2.7, 12.3.0 - 12.3.5, 12.4.0 - 12.4.1
Timeline
- 2026-07-07: advisory
- 2026-07-07: disclosed