CVE-2026-28378 — Cross-Organization Public Dashboard Deletion via Missing Org Isolation
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different or…
Published: 2026-07-07 · CVSS: 3.1 · CVSS 3.1
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7