Description

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-26T09:16:45.727Z",
  "pubdate": "2026-08-26T09:16:45.727Z",
  "executiveSummary": "This vulnerability is a broken access control flaw within Grafana that permits an authenticated user with organization administrator privileges to perform unauthorized administrative actions on resources belonging to other organizations within the same Grafana instance.\nThe issue manifests in two primary ways: the unauthorized deletion of dashboard snapshots across organizational boundaries and the systematic recovery of secret delete keys using only the corresponding public share key.\nThis vulnerability poses a significant risk to data integrity and availability, as an attacker with administrative access in one organization can maliciously purge sensitive snapshots belonging to other entities hosted on the shared instance.\nThe exploitation of this flaw does not require system-level access but relies on the misconfiguration of access control checks at the application level, specifically during the handling of snapshot management requests.\nBy bypassing organizational isolation, an attacker can effectively compromise data that should be logically sequestered, leading to potential data loss scenarios and the unauthorized removal of shared analytics or operational documentation across the entire multi-tenant environment.",
  "technicalDetails": "The vulnerability resides in the Grafana snapshot management API, which fails to correctly validate the organizational scope of the requesting user against the target resource's metadata.\nRoot cause analysis indicates a failure in the authorization middleware to enforce strict tenant isolation for the snapshot deletion and metadata retrieval functions. While the application recognizes the user's administrative status within their own organization, it erroneously assumes that this privilege allows for cross-organization interaction when performing snapshot-related operations.\nThe exploitation flow for the delete key recovery involves an attacker utilizing a known public share key. Due to the lack of restrictive validation on the backend, the API permits an authenticated administrator to query snapshot details by the public key. The response, intended to be restricted to the owner of the resource, improperly discloses the 'deleteKey' field.\nOnce the secret delete key is obtained, the attacker can leverage the dashboard snapshot deletion endpoint. By submitting a request with the harvested key, the backend validates the key but neglects to verify if the user's current organizational context matches the organization associated with the snapshot resource. This logical failure allows the request to be processed, resulting in the deletion of the dashboard snapshot regardless of the target's organizational ownership.\nThis behavior facilitates a cross-tenant attack vector where the logical separation of data is nullified by the API's failure to verify resource ownership during the execution of sensitive operations. The attack is highly impactful in multi-tenant Grafana instances where multiple organizations reside on a single server, as it grants attackers the ability to impact the availability of data globally across the instance, despite being limited to administrative permissions within a single, isolated organization context. There is no requirement for sophisticated bypasses or memory corruption; the vulnerability is purely a result of flawed access control logic in the API authorization layer."
}