BIT-grafana-2026-28378

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2026-28378.json
JSON Data
https://api.test.osv.dev/v1/vulns/BIT-grafana-2026-28378
Aliases
Published
2026-07-12T23:42:10Z
Modified
2026-07-13T06:30:07Z
Summary
Cross-Organization Public Dashboard Deletion via Missing Org Isolation
Details

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.

Database specific 
{
    "cpes":  [
        "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*"
    ],
    "severity":  "Low"
}
References

Affected packages

Bitnami / grafana

Package

Name
grafana
Purl
pkg:bitnami/grafana

Severity

  • 2.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
11.6.0
Fixed
11.6.14
Introduced
12.1.0
Fixed
12.1.10
Introduced
12.2.0
Fixed
12.2.8
Introduced
12.3.0
Fixed
12.3.6
Introduced
12.4.0
Fixed
12.4.1

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2026-28378.json"