Description
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.
Metrics
CVSS 3.1 2.7/10
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana Enterprise | >= 11.6.0, <= 11.6.13; >= 12.1.0, <= 12.1.9; >= 12.2.0, <= 12.2.7; >= 12.3.0, <= 12.3.5; >= 12.4.0, <= 12.4.1 |
| Grafana | Grafana OSS | >= 11.6.0, <= 11.6.13; >= 12.1.0, <= 12.1.9; >= 12.2.0, <= 12.2.7; >= 12.3.0, <= 12.3.5; >= 12.4.0, <= 12.4.1 |
References
Timeline
- Published
- Jul 7, 2026
- Last modified
- Jul 10, 2026
- NVD status
- Analyzed