CVE-2026-28378: Grafana Cross-Organization Dashboard Deletion Vulnerability

Technical summary

CVE-2026-28378 is an authorization bypass vulnerability in Grafana affecting the public dashboard deletion endpoint. The vulnerability manifests as an improper access control issue (CWE-284) where the endpoint fails to enforce organization isolation. An org admin authenticated to one organization can delete public dashboards in other organizations by directly referencing their dashboard identifiers. The attack requires valid authentication credentials but does not require user interaction. The CVSS 3.1 score of 3.1 (LOW) reflects limited confidentiality impact (integrity only, no data disclosure or availability impact) and the requirement for authenticated access.

Business impact

This vulnerability enables malicious or disgruntled administrators to disrupt visibility and monitoring for other organizations sharing a Grafana instance. Deletion of public dashboards can cause loss of shared operational insights, reporting disruption, and potential compliance issues if dashboards are used for audit trails or SLA tracking. The impact is primarily organizational—affecting dashboard availability and trust—rather than system-wide. For multi-tenant Grafana deployments, this represents a control plane isolation failure that could undermine organizational segmentation and governance.

Affected systems

Grafana instances are affected by this vulnerability. The exact versions susceptible to this flaw have not been specified in available advisories; organizations should verify their Grafana deployment version against the official Grafana security advisory for precise version ranges. The vulnerability applies to Grafana deployments with multiple organizations configured and public dashboards shared across them.

Exploitability

Exploitation requires valid Grafana authentication credentials with org admin privileges in at least one organization. The attacker must know or enumerate the target dashboard identifiers (which may be derivable or discoverable). While the bar for initial access is moderate—credentials and privileges are needed—the actual exploitation is straightforward once authenticated: a simple API request with a cross-organization dashboard ID can trigger deletion. The attack surface is direct and deterministic, with no user interaction required. However, the need for authentication and the relatively obscure nature of cross-org attacks in typical deployments limit real-world risk.

Remediation

Organizations should immediately apply the patch provided by Grafana that implements proper organization isolation checks on the dashboard deletion endpoint. Verify that the patched version enforces that an org admin can only delete dashboards within their own organization. As an interim mitigation, restrict dashboard deletion permissions, audit org admin role assignments, and review dashboard deletion audit logs for any unauthorized removals. Ensure role-based access controls (RBAC) are properly configured and regularly reviewed.

Patch guidance

Apply the latest Grafana security update that addresses organization isolation in the dashboard deletion endpoint. Verify against the official Grafana security advisory for the specific version numbers that remediate CVE-2026-28378. Test the patch in a staging environment before production deployment to confirm dashboard deletion is properly restricted to the administrator's own organization.

Detection guidance

Monitor Grafana audit logs for dashboard deletion events, particularly those occurring outside normal maintenance windows or by unexpected administrators. Correlate deletion events with the organization context to identify cross-organization deletions. Use API request logging to track calls to the dashboard deletion endpoint with dashboard IDs belonging to other organizations. Alert on any dashboard deletions by org admins targeting dashboards they should not have access to. Review Grafana's access logs and API audit trails for suspicious deletion patterns or failed authorization attempts.

Why prioritize this

Although rated LOW in severity, this vulnerability should be prioritized for multi-tenant Grafana deployments and environments where organizational isolation is a security or compliance requirement. Organizations in regulated industries (finance, healthcare) using Grafana for multi-customer or multi-department visibility should patch promptly to maintain isolation guarantees. Single-organization deployments can deprioritize but should still plan patching within normal update cycles. The vulnerability represents a control plane gap that, while limited in blast radius, directly contradicts expected access control behavior.

Risk score, explained

The CVSS 3.1 score of 3.1 (LOW) reflects: authenticated attack vector (requires valid credentials), high attack complexity (must identify valid cross-org dashboard IDs and have org admin role), limited scope (impact confined to integrity of dashboards in other orgs, no data disclosure or system availability loss), and no direct confidentiality or availability impact. The low score appropriately captures the narrow attack surface and limited consequence, though does not fully represent the organizational impact in multi-tenant deployments where isolation is contractually or compliance-critical.

Frequently asked questions