Grafana CVE-2026-28378

Exploitation requires the attacker to hold an authenticated Org Admin role (PR:L per CVSS vector) within any organization on the target Grafana instance - this is not an unauthenticated or anonymous attack. The target resource must be a public dashboard; the vulnerability is specific to the public dashboard deletion endpoint and does not apply to all dashboard types. The attacker must also know or successfully enumerate the target dashboard's unique identifier (e.g., UID), which is the source of the AC:H rating and the primary practical barrier. Exploitation is meaningful only in multi-tenant Grafana deployments where Org Admins from different, mutually untrusted organizations share the same instance. Single-tenant deployments and deployments where all Org Admins are equally trusted are not meaningfully at risk. No user interaction from the victim organization is required once the dashboard identifier is known.

The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) scores 3.1, correctly reflecting a network-reachable but authentication-gated and complexity-constrained flaw with limited integrity impact. The AC:H rating acknowledges that an attacker must obtain or enumerate dashboard identifiers belonging to another organization, which is a meaningful barrier. No EPSS data is available to quantify exploitation probability, no CISA KEV listing exists, and no public proof-of-concept code has been identified - all signals point to low immediate exploitation urgency. Real-world risk is almost entirely confined to multi-tenant Grafana deployments where administrators of different, mutually untrusted organizations coexist on the same instance; self-hosted or single-tenant deployments where all Org Admins are trusted present negligible exposure. The absence of confidentiality and availability impact means the worst-case outcome is loss of public dashboard resources, not data exfiltration or service disruption.

An attacker with Org Admin credentials in Organization A enumerates or infers the UID of a public dashboard belonging to Organization B - for example, by observing shared dashboard links or through API enumeration - then issues a DELETE request to the public dashboard deletion endpoint using that UID. Because the endpoint does not validate organizational ownership, the request succeeds and the target dashboard is permanently deleted. No public proof-of-concept code exists at time of analysis.