What is the CVSS score of CVE-2026-28378?

CVE-2026-28378 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Grafana CVE-2026-28378

EUVD-2026-42109 LOW

Improper Access Control (CWE-284)

2026-07-07 GRAFANA

GHSA-x94r-qqxh-wpj5

Authentication Bypass Grafana Grafana Oss Grafana Enterprise

2.7

CVSS 3.1 · NVD

Severity by source

Vendor (GRAFANA) PRIMARY

LOW

qualitative

NVD

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.1 LOW

Requires authenticated Org Admin role (PR:L) and knowledge of cross-org dashboard identifiers (AC:H); impact is limited to cross-tenant deletion (I:L) with no confidentiality or availability effect.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GRAFANA).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jul 10, 2026 - 16:07 NVD

3.1 (LOW) 2.7 (LOW)

Analysis Generated

Jul 07, 2026 - 22:08 vuln.today

DescriptionNVD

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.

AnalysisAI

Cross-organization authorization bypass in Grafana OSS and Enterprise allows an authenticated Org Admin to delete public dashboards owned by a different organization by supplying the target dashboard's identifiers to the deletion endpoint. The missing tenant-isolation check on the delete operation means any Org Admin - regardless of their organizational scope - can reach and destroy dashboards across organizational boundaries. No public exploit has been identified at time of analysis, and the low CVSS score of 3.1 reflects the constrained impact and prerequisite of an existing Org Admin credential.

Technical ContextAI

Grafana's multi-tenant architecture segments resources by organization, with Org Admins granted administrative control only within their assigned organization. Both Grafana OSS (cpe:2.3:a:grafana:grafana_oss:*:*:*:*:*:*:*:*) and Grafana Enterprise (cpe:2.3:a:grafana:grafana_enterprise:*:*:*:*:*:*:*:*) are affected. The vulnerability arises in the public dashboard deletion API endpoint, which accepts dashboard identifiers (such as UIDs) but fails to verify that the authenticated requester's organization matches the organization that owns the target dashboard. No CWE is formally assigned, but the root cause class is consistent with CWE-639 (Authorization Bypass Through User-Controlled Key) or CWE-284 (Improper Access Control) - the endpoint trusts a caller-supplied identifier without a tenant-ownership assertion.

RemediationAI

Consult the Grafana security advisory at https://grafana.com/security/security-advisories/cve-2026-28378 for the vendor-released patched version - no exact fix version number is confirmed from the available data, so the patch version must be taken directly from the advisory. As a compensating control prior to patching in multi-tenant environments, audit and minimize Org Admin role assignments to only fully trusted internal users, since exploitation requires holding this role. Organizations operating Grafana in single-tenant mode or where all Org Admins belong to the same trust domain have negligible residual risk. Monitoring public dashboard activity logs for unexpected deletion events can serve as a detection mechanism while a patch is evaluated.