CVE-2026-28378

Cross-Organization Public Dashboard Deletion via Missing Org Isolation

3.1 LowFix available

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.23%Up 0.1 points since Jul 8, 2026

What each source reports

CVE List Score used 3.1

Cross-Organization Public Dashboard Deletion via Missing Org Isolation

Record: CVE-2026-28378
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-284
Updated: 2026-11-02

EUVDEUVD-2026-42109 3.1

Record: EUVD-2026-42109
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-x94r-qqxh-wpj5 3.1

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org...

Record: GHSA-x94r-qqxh-wpj5
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-284
Updated: 2026-11-02

NVD 3.1

Record: CVE-2026-28378
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1: 2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-284
Updated: 2026-11-02

OSV 3.1

Cross-Organization Public Dashboard Deletion via Missing Org Isolation

Record: CVE-2026-28378
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVRHSA-2026:66008 8.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:66008
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBIT-grafana-2026-28378 No score

Cross-Organization Public Dashboard Deletion via Missing Org Isolation

Record: BIT-grafana-2026-28378
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`grafana` Bitnami	11.6.0 up to 11.6.14, 12.1.0 up to 12.1.10, 12.2.0 up to 12.2.8, 12.3.0 up to 12.3.6, 12.4.0 up to 12.4.1	11.6.1412.1.1012.2.812.3.612.4.1
`grafana12.4` Red Hat:hummingbird:1 From an advisory covering 12 CVEs	before 0:12.4.10-0.2.hum1	0:12.4.10-0.2.hum1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-28378 is a low vulnerability (CVSS 3.1) in Grafana Oss, published July 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in grafana 11.6.14.

References

Show 61 moreShow less