The vulnerability in Grafana Enterprise (CVE-2026-28378) arises because the public dashboard deletion endpoint does not properly enforce organization isolation controls. As a result, an Org Admin with limited privileges in one organization can delete public dashboards from a different organization by supplying the identifiers of those dashboards. This issue is categorized under CWE-284 (Improper Access Control). The CVSS 3.1 base score is 3.1, reflecting low impact due to the requirement for network access, high attack complexity, and limited privileges needed. No official remediation or patch information is available at this time.

An Org Admin in one organization can delete public dashboards belonging to other organizations, potentially causing loss of publicly shared dashboard data. There is no impact on confidentiality or availability beyond the deletion of dashboards, and no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting Org Admin privileges and monitor dashboard management activities to detect unauthorized deletions.