Description
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana Enterprise | 11.6.0 – ≤ 11.6.13, 12.1.0 – ≤ 12.1.9, 12.2.0 – ≤ 12.2.7, 12.3.0 – ≤ 12.3.5, 12.4.0 – ≤ 12.4.1 | — |
| Grafana | Grafana OSS | 11.6.0 – ≤ 11.6.13, 12.1.0 – ≤ 12.1.9, 12.2.0 – ≤ 12.2.7, 12.3.0 – ≤ 12.3.5, 12.4.0 – ≤ 12.4.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.10-0.2.hum1 | RHSA-2026:66008 |
Advisories 1
- RHSA-2026:66008 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-28378 vendor-advisory