{"id":"CVE-2026-28378","aliases":["BIT-grafana-2026-28378","EUVD-2026-42109","GHSA-x94r-qqxh-wpj5","RHSA-2026:66008"],"status":"published","title":"Cross-Organization Public Dashboard Deletion via Missing Org Isolation","description":"The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00227,"percentile":0.13505,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2026-07-07T21:08:04Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"Bitnami","package":"grafana","fixed_in":["11.6.14","12.1.10","12.2.8","12.3.6","12.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"11.6.0"},{"fixed":"11.6.14"},{"introduced":"12.1.0"},{"fixed":"12.1.10"},{"introduced":"12.2.0"},{"fixed":"12.2.8"},{"introduced":"12.3.0"},{"fixed":"12.3.6"},{"introduced":"12.4.0"},{"fixed":"12.4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.10-0.2.hum1"}]}],"bundled":12}],"products":[{"vendor":"grafana","product":"grafana"},{"vendor":"grafana","product":"grafana enterprise"},{"vendor":"grafana","product":"grafana oss"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-28378","tags":["vendor-advisory","Broken Link","web","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28378","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-x94r-qqxh-wpj5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28378.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66008","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84961","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19534","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18540","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84933","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18149","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84947","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85008","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84890","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85014","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14199","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28378","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19197","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66008.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521850","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14199","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14199","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-14199/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528802","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18149","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528783","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18540","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524303","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19197","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19197","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-19197","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528759","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19534","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19534","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497887","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28378","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528772","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84890","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84890","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528756","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84933","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84947","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84947","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528735","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84961","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528747","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85008","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85008","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528712","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85014","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85014","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2026-28378","title":"Cross-Organization Public Dashboard Deletion via Missing Org Isolation","description":"The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.","status":"published","published":"2026-07-07T21:08:04.579Z","modified":"2026-08-27T17:22:38.899Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:20:01.969981Z"}],"euvd":[{"id":"EUVD-2026-42109","description":"The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.","status":"published","published":"2026-07-07T21:08:04Z","modified":"2026-08-27T17:22:38Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T18:01:27.27583Z"}],"ghsa":[{"id":"GHSA-x94r-qqxh-wpj5","title":"The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org...","description":"The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.","status":"published","published":"2026-07-08T00:37:54Z","modified":"2026-07-09T18:32:40Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:09:22.189239Z"}],"nvd":[{"id":"CVE-2026-28378","description":"The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.","status":"published","published":"2026-07-07T22:16:50.607Z","modified":"2026-07-10T16:05:56.213Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:12:28.040501Z"}],"osv":[{"id":"CVE-2026-28378","title":"Cross-Organization Public Dashboard Deletion via Missing Org Isolation","description":"The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.","status":"published","published":"2026-07-07T21:08:04.579Z","modified":"2026-10-28T02:31:00.564031455Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"RHSA-2026:66008","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-10T10:17:09Z","modified":"2026-10-20T10:43:33.340874063Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"BIT-grafana-2026-28378","title":"Cross-Organization Public Dashboard Deletion via Missing Org Isolation","description":"The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.","status":"published","published":"2026-07-12T23:42:10.272Z","modified":"2026-07-13T06:15:07.738301714Z","updated_at":"2026-11-02T15:28:31.02759Z"}]}}