{"id":"CVE-2025-3260","aliases":["ALPINE-CVE-2025-3260","BIT-grafana-2025-3260","EUVD-2025-16627","GHSA-3px7-c4j3-576r","GO-2025-3740","UBUNTU-CVE-2025-3260","openSUSE-SU-2025:15225-1"],"status":"published","title":"Grafana vulnerable to authenticated users bypassing dashboard, folder permissions","description":"A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).\n\nImpact:\n\n- Viewers can view all dashboards/folders regardless of permissions\n\n- Editors can view/edit/delete all dashboards/folders regardless of permissions\n\n- Editors can create dashboards in any folder regardless of permissions\n\n- Anonymous users with viewer/editor roles are similarly affected\n\nOrganization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0056,"percentile":0.47068,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2025-06-02T10:06:39Z","modified":"2026-11-03T22:02:58Z","fixes":[{"ecosystem":"Go","package":"github.com/grafana/grafana","fixed_in":["0.0.0-20250521183405-c7a690348df7"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.22","package":"grafana","fixed_in":["11.6.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"grafana","fixed_in":["11.6.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"grafana","fixed_in":["11.6.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"grafana","fixed_in":["11.6.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.0-20250114093457-36d6fad421fb"},{"fixed":"0.0.0-20250521183405-c7a690348df7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"11.6.0"},{"fixed":"11.6.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-20250114093457-36d6fad421fb"},{"fixed":"0.0.0-20250521183405-c7a690348df7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-20250114093457-36d6fad421fb"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250612T141001-1.1"}]}],"bundled":29}],"products":[{"vendor":"grafana","product":"grafana"}],"references":[{"url":"https://grafana.com/security/security-advisories/CVE-2025-3260/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3260","tags":["web","advisory"]},{"url":"https://grafana.com/security/security-advisories/CVE-2025-3260","tags":["web"]},{"url":"https://github.com/grafana/grafana/blob/be8d153dc33734caba4f617ff571d18253e68fa0/CHANGELOG.md#1161-2025-04-23","tags":["web"]},{"url":"https://grafana.com/blog/2025/04/22/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-3260-cve-2025-2703-cve-2025-3454","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3px7-c4j3-576r","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-3260","tags":["advisory"]},{"url":"https://github.com/grafana/grafana","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-3260","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-3260","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49140","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-3260","description":"A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).\n\nImpact:\n\n- Viewers can view all dashboards/folders regardless of permissions\n\n- Editors can view/edit/delete all dashboards/folders regardless of permissions\n\n- Editors can create dashboards in any folder regardless of permissions\n\n- Anonymous users with viewer/editor roles are similarly affected\n\nOrganization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.","status":"published","published":"2025-06-02T10:06:39.039Z","modified":"2026-11-03T22:02:58.937Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-03T23:33:08.294318Z"}],"euvd":[{"id":"EUVD-2025-16627","description":"A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).\n\nImpact:\n\n- Viewers can view all dashboards/folders regardless of permissions\n\n- Editors can view/edit/delete all dashboards/folders regardless of permissions\n\n- Editors can create dashboards in any folder regardless of permissions\n\n- Anonymous users with viewer/editor roles are similarly affected\n\nOrganization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.","status":"published","published":"2025-06-02T10:06:39Z","modified":"2026-11-03T22:02:58Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-03T23:01:35.361827Z"}],"ghsa":[{"id":"GHSA-3px7-c4j3-576r","title":"Grafana vulnerable to authenticated users bypassing dashboard, folder permissions","description":"A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).\n\nImpact:\n\n- Viewers can view all dashboards/folders regardless of permissions\n\n- Editors can view/edit/delete all dashboards/folders regardless of permissions\n\n- Editors can create dashboards in any folder regardless of permissions\n\n- Anonymous users with viewer/editor roles are similarly affected\n\nOrganization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.","status":"published","published":"2025-06-02T12:30:33Z","modified":"2025-06-05T01:04:02Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:38:45.948817Z"}],"nvd":[{"id":"CVE-2025-3260","description":"A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).\n\nImpact:\n\n- Viewers can view all dashboards/folders regardless of permissions\n\n- Editors can view/edit/delete all dashboards/folders regardless of permissions\n\n- Editors can create dashboards in any folder regardless of permissions\n\n- Anonymous users with viewer/editor roles are similarly affected\n\nOrganization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.","status":"published","published":"2025-06-02T10:15:21.74Z","modified":"2026-06-17T09:19:32.65Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:11:10.143444Z"}],"osv":[{"id":"ALPINE-CVE-2025-3260","description":"A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).\n\nImpact:\n\n- Viewers can view all dashboards/folders regardless of permissions\n\n- Editors can view/edit/delete all dashboards/folders regardless of permissions\n\n- Editors can create dashboards in any folder regardless of permissions\n\n- Anonymous users with viewer/editor roles are similarly affected\n\nOrganization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.","status":"published","published":"2025-06-02T10:15:21.74Z","modified":"2026-11-03T06:33:00.398435348Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"GHSA-3px7-c4j3-576r","title":"Grafana vulnerable to authenticated users bypassing dashboard, folder permissions","description":"A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).\n\nImpact:\n\n- Viewers can view all dashboards/folders regardless of permissions\n\n- Editors can view/edit/delete all dashboards/folders regardless of permissions\n\n- Editors can create dashboards in any folder regardless of permissions\n\n- Anonymous users with viewer/editor roles are similarly affected\n\nOrganization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.","status":"published","published":"2025-06-02T12:30:33Z","modified":"2026-09-10T03:50:24.785306297Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"UBUNTU-CVE-2025-3260","description":"A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1). Impact: - Viewers can view all dashboards/folders regardless of permissions - Editors can view/edit/delete all dashboards/folders regardless of permissions - Editors can create dashboards in any folder regardless of permissions - Anonymous users with viewer/editor roles are similarly affected Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.","status":"published","published":"2025-06-02T10:15:00Z","modified":"2025-10-24T05:16:31Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T16:55:28.829873Z"},{"id":"BIT-grafana-2025-3260","description":"A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).\n\nImpact:\n\n- Viewers can view all dashboards/folders regardless of permissions\n\n- Editors can view/edit/delete all dashboards/folders regardless of permissions\n\n- Editors can create dashboards in any folder regardless of permissions\n\n- Anonymous users with viewer/editor roles are similarly affected\n\nOrganization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.","status":"published","published":"2025-06-04T14:44:55.391Z","modified":"2025-06-09T18:44:14.403866Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"GO-2025-3740","title":"Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in github.com/grafana/grafana","description":"Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in github.com/grafana/grafana.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/grafana/grafana before v0.0.0-20250521183405-c7a690348df7.","status":"published","published":"2025-06-09T18:14:36Z","modified":"2026-06-19T12:44:23.018540382Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:15225-1","title":"govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250612T141001-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:30.823164Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}