CVE-2026-28378
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.
Risk Assessment
The risk is unauthorized deletion of public dashboards by an admin from another organization, potentially causing data loss and service disruption.
Recommendation
Immediately implement organization isolation in the public dashboard deletion endpoint to verify dashboard ownership before performing the operation.
Other vulnerabilities in Grafana
See all- CVE-2026-28381Critical
The Snowflake datasource vulnerability allows GET/PUT commands, enabling any user with query access to read/write files between the local Grafana server and the connected Snowflake host.
- CVE-2026-27876Critical
A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to remote arbitrary code execution (RCE). The vulnerability requires the sqlExpressions feature toggle to be enabled and affects specific Grafana OSS versions.
- CVE-2025-41115Critical
In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which could allow overriding internal user IDs and lead to impersonation or privilege escalation.
- CVE-2023-3128Critical
Grafana validates Azure AD accounts based on the email claim. The email field in Azure AD profiles is not unique and can be easily modified, leading to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
- CVE-2021-43798HighActively exploited
Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) is vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. Grafana Cloud has never been vulnerable.
- CVE-2021-39226CriticalActively exploited
Grafana has a vulnerability that allows unauthenticated and authenticated users to view snapshots with the lowest database key by accessing specific paths. If the public_mode setting is enabled, unauthenticated users can also delete such snapshots. Authenticated users can delete snapshots regardless of this setting, leading to complete snapshot data loss.
- CVE-2026-15815High
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted archive can chain relative symlinks to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside it, which then runs with Grafana server privileges.
- CVE-2026-19475Medium
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.
- CVE-2026-14199High
A vulnerability in Grafana (only self-managed instances with Auth Proxy authentication and identity caching enabled) where the Auth Proxy cache key concatenates username and forwarded identity attributes without a delimiter, allowing distinct identities to collide. An authenticated user can spoof a higher-privileged user.
- CVE-2026-19197Medium
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).
Original NVD description (English source)
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS