CVE-2026-28378

Cross-Organization Public Dashboard Deletion via Missing Org Isolation

Low · published July 7, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
12.7
In the wild
Unconfirmed
What it is

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00227 · 12.7th percentile
Published
2026-07-07T21:08Z
EPSS history
Timeline
  • 07 JUL 21:08Z
    Cross-Organization Public Dashboard Deletion via Missing Org Isolation
    cvelistv5