A vulnerability in Grafana's RBAC service caused it to ignore the requested folder when verifying folder administrator status for deleted dashboard listings. This flaw allowed users with dashboard permission-management rights on any folder to be treated as administrators of all folders, potentially exposing deleted dashboard items from folders where they lacked administrative access. The issue is addressed by requiring permission on the specified folder, an ancestor folder, or a wildcard scope.