CVE-2026-28378 Overview
CVE-2026-28378 is a broken access control vulnerability in Grafana's public dashboard deletion endpoint. The endpoint fails to enforce organization isolation, allowing an Organization Administrator (Org Admin) authenticated in one Grafana organization to delete public dashboards belonging to a separate organization. Exploitation requires the attacker to supply the target dashboard's identifiers. The flaw affects data integrity and multi-tenant boundaries within Grafana deployments that host multiple organizations on a shared instance.
Critical Impact
An authenticated Org Admin can delete public dashboards owned by other organizations, breaking tenant isolation and causing loss of dashboard availability for unrelated tenants.
Affected Products
- Grafana (public dashboard feature) - see the Grafana Security Advisory CVE-2026-28378 for affected versions
- Multi-tenant Grafana deployments with more than one organization configured
- Self-hosted Grafana instances exposing the public dashboards API
Discovery Timeline
- 2026-07-07 - CVE-2026-28378 published to the National Vulnerability Database (NVD)
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-28378
Vulnerability Analysis
The vulnerability resides in the API handler responsible for deleting public dashboards. The handler validates that the caller holds Org Admin privileges but does not verify that the referenced dashboard belongs to the caller's active organization. As a result, an authenticated Org Admin in Organization A can issue a delete request naming a public dashboard identifier owned by Organization B and the server processes the request.
The issue is a form of Insecure Direct Object Reference combined with Broken Access Control. Grafana's tenancy model relies on server-side org scoping for every object lookup and mutation. When that scoping check is absent from a mutation path, cross-tenant destructive actions become possible. The impact is limited to integrity (dashboard deletion) and does not expose dashboard contents or authentication material.
Exploitation complexity is elevated because the attacker must already hold Org Admin credentials in some organization on the target instance and must know or enumerate the public dashboard UID or access token of the victim organization.
Root Cause
The delete handler for public dashboards performs role authorization but omits the organization ownership check. The lookup keyed on the public dashboard identifier does not constrain the query to the caller's orgId, so the record resolves globally rather than within the tenant boundary.
Attack Vector
The attack is network-based and authenticated. An Org Admin in any organization on the shared Grafana instance sends a delete request to the public dashboard endpoint with the target dashboard identifiers. The request succeeds despite the caller having no rights over the target organization's resources. Refer to the Grafana Security Advisory for endpoint specifics and affected versions.
Detection Methods for CVE-2026-28378
Indicators of Compromise
- Unexpected DELETE requests against /api/dashboards/public-dashboards/ routes in Grafana access logs
- Public dashboards that disappear from an organization without a corresponding action in that organization's audit trail
- Delete events in Grafana audit logs where the actor's orgId does not match the target dashboard's owning organization
- Support tickets from tenants reporting missing public dashboards without internal explanation
Detection Strategies
- Correlate Grafana audit log entries for public dashboard deletions against the owning organization ID and flag mismatches
- Alert on any Org Admin performing deletions across multiple orgId values within a short window
- Baseline normal public dashboard deletion rates per organization and alert on spikes
Monitoring Recommendations
- Forward Grafana application and audit logs to a centralized SIEM or data lake for cross-org correlation
- Enable Grafana's audit logging feature and retain events long enough to support incident response
- Monitor administrative role assignments across organizations to identify accounts with elevated exposure
How to Mitigate CVE-2026-28378
Immediate Actions Required
- Apply the patched Grafana release identified in the Grafana Security Advisory CVE-2026-28378
- Review the list of accounts holding Org Admin in any organization and remove unnecessary grants
- Audit recent public dashboard deletions across all organizations to identify unauthorized removals
- Restore any dashboards deleted without a legitimate change record from backup
Patch Information
Grafana Labs has published a security advisory for CVE-2026-28378 with fixed version details. Consult the Grafana Security Advisory for the exact patched releases and upgrade guidance for self-hosted deployments. Grafana Cloud instances are updated by the vendor.
Workarounds
- Restrict Org Admin role assignment to a minimal set of trusted operators until patching is complete
- Disable the public dashboards feature on multi-tenant instances where cross-organization impact is unacceptable
- Place Grafana behind a reverse proxy that restricts access to /api/dashboards/public-dashboards/ delete methods to known administrative networks
- Increase backup frequency for dashboard configuration to reduce recovery time from unauthorized deletion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
