CVE-2026-28378

2.7 lowEPSS 0.2%

Low (2.7) in grafana grafana. EPSS 0.2% chance of exploitation in the next 30 days.

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.

Severity

CVSS 3.1

2.7 low

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
CWE: CWE-284
Published: 2026-07-07
Modified: 2026-07-10
Record from: the NVD, synced 2026-10-19

Affected

grafana:grafana

References

https://grafana.com/security/security-advisories/cve-2026-28378

Check your stack JSON