CVE-2026-28378: Cross-Organization Public Dashboard Deletion via Missing Org Isolation
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28378?
The severity of CVE-2026-28378 is classified as low with a score of 3.1.
What does CVE-2026-28378 affect?
CVE-2026-28378 affects the public dashboard deletion endpoint lacking organization isolation.
How can I mitigate CVE-2026-28378?
To mitigate CVE-2026-28378, ensure that organization isolation is enforced on the public dashboard deletion endpoint.
What are the risks associated with CVE-2026-28378?
The risks associated with CVE-2026-28378 include potential unauthorized deletion of public dashboards by Org Admins from different organizations.
Is there any impact on data confidentiality from CVE-2026-28378?
CVE-2026-28378 does not affect data confidentiality as it does not involve unauthorized data access.