CVE-2026-28378

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28378", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-02-27T07:16:12.218Z", "datePublished": "2026-07-07T21:08:04.579Z", "dateUpdated": "2026-08-27T17:22:38.899Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-27T17:22:38.899Z"}, "datePublic": "2026-03-24T15:50:26.000Z", "title": "Cross-Organization Public Dashboard Deletion via Missing Org Isolation", "descriptions": [{"lang": "en", "value": "The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers."}], "affected": [{"vendor": "Grafana", "product": "Grafana Enterprise", "defaultStatus": "unaffected", "versions": [{"version": "11.6.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "11.6.13"}, {"version": "12.1.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.1.9"}, {"version": "12.2.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.2.7"}, {"version": "12.3.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.3.5"}, {"version": "12.4.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.4.1"}]}, {"vendor": "Grafana", "product": "Grafana OSS", "defaultStatus": "unaffected", "versions": [{"version": "11.6.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "11.6.13"}, {"version": "12.1.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.1.9"}, {"version": "12.2.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.2.7"}, {"version": "12.3.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.3.5"}, {"version": "12.4.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "12.4.1"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-28378", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "credits": [{"lang": "en", "value": "rpgsec (Researcher)", "type": "finder"}], "source": {"discovery": "BUG_BOUNTY"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "CWE-284 Improper Access Control"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-08T13:50:28.034051Z", "id": "CVE-2026-28378", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T15:38:39.070Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28378", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T13:50:28.034051Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T13:52:44.839Z"}}], "cna": {"title": "Cross-Organization Public Dashboard Deletion via Missing Org Isolation", "source": {"discovery": "BUG_BOUNTY"}, "credits": [{"lang": "en", "type": "finder", "value": "rpgsec (Researcher)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "Grafana", "product": "Grafana Enterprise", "versions": [{"status": "affected", "version": "11.6.0", "versionType": "semver", "lessThanOrEqual": "11.6.13"}, {"status": "affected", "version": "12.1.0", "versionType": "semver", "lessThanOrEqual": "12.1.9"}, {"status": "affected", "version": "12.2.0", "versionType": "semver", "lessThanOrEqual": "12.2.7"}, {"status": "affected", "version": "12.3.0", "versionType": "semver", "lessThanOrEqual": "12.3.5"}, {"status": "affected", "version": "12.4.0", "versionType": "semver", "lessThanOrEqual": "12.4.1"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "11.6.0", "versionType": "semver", "lessThanOrEqual": "11.6.13"}, {"status": "affected", "version": "12.1.0", "versionType": "semver", "lessThanOrEqual": "12.1.9"}, {"status": "affected", "version": "12.2.0", "versionType": "semver", "lessThanOrEqual": "12.2.7"}, {"status": "affected", "version": "12.3.0", "versionType": "semver", "lessThanOrEqual": "12.3.5"}, {"status": "affected", "version": "12.4.0", "versionType": "semver", "lessThanOrEqual": "12.4.1"}], "defaultStatus": "unaffected"}], "datePublic": "2026-03-24T15:50:26.000Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-28378", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers."}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-27T17:22:38.899Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28378", "state": "PUBLISHED", "dateUpdated": "2026-08-27T17:22:38.899Z", "dateReserved": "2026-02-27T07:16:12.218Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-07-07T21:08:04.579Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "11.6.13", "status": "affected", "version": "11.6.0", "versionType": "semver"}, {"lessThanOrEqual": "12.1.9", "status": "affected", "version": "12.1.0", "versionType": "semver"}, {"lessThanOrEqual": "12.2.7", "status": "affected", "version": "12.2.0", "versionType": "semver"}, {"lessThanOrEqual": "12.3.5", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThanOrEqual": "12.4.1", "status": "affected", "version": "12.4.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "11.6.13", "status": "affected", "version": "11.6.0", "versionType": "semver"}, {"lessThanOrEqual": "12.1.9", "status": "affected", "version": "12.1.0", "versionType": "semver"}, {"lessThanOrEqual": "12.2.7", "status": "affected", "version": "12.2.0", "versionType": "semver"}, {"lessThanOrEqual": "12.3.5", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThanOrEqual": "12.4.1", "status": "affected", "version": "12.4.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "9D59F356-7EE6-4323-B32B-6AA9895E4DF1", "versionEndIncluding": "11.6.13", "versionStartIncluding": "11.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "819B8356-78D3-481E-90E0-E06904E3597F", "versionEndIncluding": "11.6.13", "versionStartIncluding": "11.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "BBDE0CB0-B614-4E8C-BCCE-1F355A2FE0E9", "versionEndIncluding": "12.1.9", "versionStartIncluding": "12.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "10C4CCFE-8186-4F2F-91E3-A7B678FC8B66", "versionEndIncluding": "12.1.9", "versionStartIncluding": "12.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "4A56F8B6-4BFF-4DBB-B645-2FF0BEDCA1FF", "versionEndIncluding": "12.2.7", "versionStartIncluding": "12.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "C8C2D5FB-AC31-4886-B455-009659BE58DB", "versionEndIncluding": "12.2.7", "versionStartIncluding": "12.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "CC445C84-CC5B-4723-86A6-88E966EBCDAA", "versionEndIncluding": "12.3.5", "versionStartIncluding": "12.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "CC523DB0-CC71-43F3-A842-5582CD1B3D90", "versionEndIncluding": "12.3.5", "versionStartIncluding": "12.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:12.4.0:*:*:*:-:*:*:*", "matchCriteriaId": "BBF9171C-F062-4FA4-8513-2D540FA072C9", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:12.4.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "34DE1833-C0AD-48FD-AD0A-E58121F62683", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers."}], "id": "CVE-2026-28378", "lastModified": "2026-07-10T16:05:56.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "security@grafana.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28378", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-08T13:50:28.034051Z", "version": "2.0.3"}}]}, "published": "2026-07-07T22:16:50.607", "references": [{"source": "security@grafana.com", "tags": ["Broken Link"], "url": "https://grafana.com/security/security-advisories/cve-2026-28378"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "grafana: Grafana: Unauthorized public dashboard deletion across organizations", "id": "2497887", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497887"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-1220", "details": ["The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.", "A flaw in Grafana's public dashboard deletion endpoint lacks organization isolation, allowing an Organization Administrator to delete public dashboards in other organizations using the target dashboard's ID."], "mitigation": {"lang": "en:us", "value": "Since this vulnerability only affects the Public Dashboards feature, environments that do not utilize public dashboards can completely neutralize the risk by disabling the feature. This removes the vulnerable endpoint from the attack surface entirely."}, "name": "CVE-2026-28378", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Not affected", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:5", "fix_state": "Not affected", "package_name": "rhceph/rhceph-5-dashboard-rhel8", "product_name": "Red Hat Ceph Storage 5"}, {"cpe": "cpe:/a:redhat:ceph_storage:6", "fix_state": "Not affected", "package_name": "rhceph/rhceph-6-dashboard-rhel9", "product_name": "Red Hat Ceph Storage 6"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Not affected", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Not affected", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Not affected", "package_name": "rhceph/grafana-rhel10", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-07T21:08:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-28378\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-28378\nhttps://grafana.com/security/security-advisories/cve-2026-28378"], "statement": "This Low impact flaw in Grafana allows an authenticated Organization Administrator to delete public dashboards belonging to other organizations. This is due to insufficient isolation enforcement in the public dashboard deletion endpoint, potentially affecting the availability of dashboards in multi-organizational Grafana deployments.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.6.0,11.6.13]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.1.0,12.1.9]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.2.0,12.2.7]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.3.0,12.3.5]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.4.0,12.4.1]"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "Grafana OSS", "source": "cna", "vendor": "Grafana"}, "product": "grafana", "vendor": "grafana"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.6.0,11.6.13]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.1.0,12.1.9]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.2.0,12.2.7]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.3.0,12.3.5]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.4.0,12.4.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Grafana Enterprise", "source": "cna", "vendor": "Grafana"}, "product": "grafana_enterprise", "vendor": "grafana"}], "created": "2026-07-08T04:15:04.314361+00:00", "updated": "2026-07-31T14:15:03.884932+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana", "grafana$PRODUCT$grafana_enterprise"]}