The vulnerability in Grafana Enterprise arises because the public dashboard deletion endpoint fails to enforce proper organization isolation controls. As a result, an Org Admin authenticated in one organization can delete public dashboards from another organization by supplying the identifiers of those dashboards. This cross-organization deletion capability violates expected access controls and could lead to unauthorized modification of dashboard resources. The issue affects versions 11.6.0, 12.1.0, 12.2.0, 12.3.0, and 12.4.0 of Grafana Enterprise. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity, low privileges, no user interaction, and impacts integrity only with no confidentiality or availability impact.

The impact is limited to unauthorized deletion of public dashboards across organizations, affecting data integrity. There is no impact on confidentiality or availability. The vulnerability requires an attacker to have Org Admin privileges in one organization, and the attack complexity is high, reducing the likelihood of exploitation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented at this time. Organizations should monitor vendor communications for updates and consider restricting Org Admin privileges to trusted personnel until a fix is available.