Odd behavior: Embedding is not enabled for this object

One of my dashboards is showing up this error in the web app it's embedded in: "Embedding is not enabled for this object."
I have 7-8 other dashboards also embedded and they're all working fine. They are parts of different collections and at first I thought it might be an issue with collection permissions. I moved the dashboard to one of the collections that contains working dashboards and still the issue is there.

Here's the chrome developer tools error message:

Failed to load resource: the server responded with a status of 400 (Bad Request)
app-embed.bundle.js:5 {status: 400, data: 'Embedding is not enabled for this object.', isCancelled: false}

Here's the relevant line in the troubleshoot logs (added .... in between):

[a878ad16-7dcc-4f9e-a332-3768a2ebb94b] 2022-06-08T17:16:55+03:00 DEBUG metabase.middleware.log GET /api/embed/dashboard/eyJhbGciOiJI......jF9.QqPbjLJJKe....vfrF2AeH2I 400 1.4 ms (1 DB calls) 
"Embedding is not enabled for this object."

Here's the diagnostic info:

  "browser-info": {
    "language": "en-PK",
    "platform": "Win32",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36",
    "vendor": "Google Inc."
  "system-info": {
    "file.encoding": "UTF-8",
    "java.runtime.name": "OpenJDK Runtime Environment",
    "java.runtime.version": "11.0.12+7-LTS",
    "java.vendor": "Amazon.com Inc.",
    "java.vendor.url": "https://aws.amazon.com/corretto/",
    "java.version": "11.0.12",
    "java.vm.name": "OpenJDK 64-Bit Server VM",
    "java.vm.version": "11.0.12+7-LTS",
    "os.name": "Linux",
    "os.version": "4.14.225-169.362.amzn2.x86_64",
    "user.language": "en",
    "user.timezone": "UTC"
  "metabase-info": {
    "databases": [
    "hosting-env": "unknown",
    "application-database": "mysql",
    "application-database-details": {
      "database": {
        "name": "MySQL",
        "version": "5.7.34-log"
      "jdbc-driver": {
        "name": "MariaDB Connector/J",
        "version": "2.6.2"
    "run-mode": "prod",
    "version": {
      "date": "2020-12-03",
      "tag": "v0.37.3",
      "branch": "release-x.37.x",
      "hash": "2f1e783"
    "settings": {
      "report-timezone": "UTC"

Hi @sanabasharat
You should upgrade immediately to a newer release: https://github.com/metabase/metabase/security/advisories/GHSA-vmm4-cwrm-38rj

Someone has likely disabled embedding of the dashboard, or you are sending a wrong dashboard ID in your embedding token.