Every CVE Search/ Get API key

CVE-2025-3260

Grafana vulnerable to authenticated users bypassing dashboard, folder permissions

8.3 HighFix available

A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).

Impact:

  • Viewers can view all dashboards/folders regardless of permissions

  • Editors can view/edit/delete all dashboards/folders regardless of permissions

  • Editors can create dashboards in any folder regardless of permissions

  • Anonymous users with viewer/editor roles are similarly affected

Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
Low

Exploit likelihood

0.56%Up 0.5 points since Jun 2, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.3

A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).

Impact:

  • Viewers can view all dashboards/folders regardless of permissions

  • Editors can view/edit/delete all dashboards/folders regardless of permissions

  • Editors can create dashboards in any folder regardless of permissions

  • Anonymous users with viewer/editor roles are similarly affected

Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.

Record
CVE-2025-3260
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Weakness
CWE-863
Updated
2026-11-03
EUVDEUVD-2025-16627 8.3

A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).

Impact:

  • Viewers can view all dashboards/folders regardless of permissions

  • Editors can view/edit/delete all dashboards/folders regardless of permissions

  • Editors can create dashboards in any folder regardless of permissions

  • Anonymous users with viewer/editor roles are similarly affected

Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.

Record
EUVD-2025-16627
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-3px7-c4j3-576r 8.3

Grafana vulnerable to authenticated users bypassing dashboard, folder permissions

A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).

Impact:

  • Viewers can view all dashboards/folders regardless of permissions

  • Editors can view/edit/delete all dashboards/folders regardless of permissions

  • Editors can create dashboards in any folder regardless of permissions

  • Anonymous users with viewer/editor roles are similarly affected

Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.

Record
GHSA-3px7-c4j3-576r
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Weakness
CWE-863
Updated
2026-11-02
NVD 8.3

A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).

Impact:

  • Viewers can view all dashboards/folders regardless of permissions

  • Editors can view/edit/delete all dashboards/folders regardless of permissions

  • Editors can create dashboards in any folder regardless of permissions

  • Anonymous users with viewer/editor roles are similarly affected

Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.

Record
CVE-2025-3260
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Weakness
CWE-863
Updated
2026-11-02
OSVALPINE-CVE-2025-3260 8.3

A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).

Impact:

  • Viewers can view all dashboards/folders regardless of permissions

  • Editors can view/edit/delete all dashboards/folders regardless of permissions

  • Editors can create dashboards in any folder regardless of permissions

  • Anonymous users with viewer/editor roles are similarly affected

Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.

Record
ALPINE-CVE-2025-3260
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Updated
2026-11-03
OSVGHSA-3px7-c4j3-576r 8.3

Grafana vulnerable to authenticated users bypassing dashboard, folder permissions

A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).

Impact:

  • Viewers can view all dashboards/folders regardless of permissions

  • Editors can view/edit/delete all dashboards/folders regardless of permissions

  • Editors can create dashboards in any folder regardless of permissions

  • Anonymous users with viewer/editor roles are similarly affected

Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.

Record
GHSA-3px7-c4j3-576r
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Weakness
CWE-863
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2025-3260 8.3

A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1). Impact: - Viewers can view all dashboards/folders regardless of permissions - Editors can view/edit/delete all dashboards/folders regardless of permissions - Editors can create dashboards in any folder regardless of permissions - Anonymous users with viewer/editor roles are similarly affected Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.

Record
UBUNTU-CVE-2025-3260
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVBIT-grafana-2025-3260 No score

A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).

Impact:

  • Viewers can view all dashboards/folders regardless of permissions

  • Editors can view/edit/delete all dashboards/folders regardless of permissions

  • Editors can create dashboards in any folder regardless of permissions

  • Anonymous users with viewer/editor roles are similarly affected

Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.

Record
BIT-grafana-2025-3260
Updated
2026-11-02
OSVGO-2025-3740 No score

Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in github.com/grafana/grafana

Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v0.0.0-20250521183405-c7a690348df7.

Record
GO-2025-3740
Updated
2026-11-02
OSVopenSUSE-SU-2025:15225-1 No score

govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250612T141001-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15225-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/grafana/grafana
Go
 0.0.0-20250114093457-36d6fad421fb up to 0.0.0-20250521183405-c7a690348df7
0.0.0-20250521183405-c7a690348df7
grafana
Alpine:v3.22
 before 11.6.1-r0
11.6.1-r0
grafana
Alpine:v3.23
 before 11.6.1-r0
11.6.1-r0
grafana
Alpine:v3.24
 before 11.6.1-r0
11.6.1-r0
grafana
Bitnami
 11.6.0 up to 11.6.1
11.6.1
github.com/grafana/grafana
Go
 0.0.0-20250114093457-36d6fad421fb and later None known
grafana
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.6.0+dfsg-1
 None known
govulncheck-vulndb
openSUSE:Tumbleweed
 before 0.0.20250612T141001-1.1
0.0.20250612T141001-1.1

History

History
RecordedChangedSources
factsCVE List, EUVD
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-3260 is a high vulnerability (CVSS 8.3) in Grafana, published June 2, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. Fixed in github.com/grafana/grafana 0.0.0-20250521183405-c7a690348df7.

References

Show 32 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open