Grafana vulnerable to authenticated users bypassing dashboard, folder permissions

高 8.3CVE-2025-3260 · BIT-grafana-2025-3260 · GHSA-3px7-c4j3-576r · 02/06/2025 公開 · 17/06/2026 更新

要点

CVE-2025-3260 は github.com/grafana/grafana に影響する深刻度「高」 (CVSS 8.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.56%（全脆弱性の 46.6% より高い）。
対処：0.0.0-20250521183405-c7a690348df7 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/grafana/grafana Go	`≥ 0.0.0-20250114093457-36d6fad421fb, < 0.0.0-20250521183405-c7a690348df7≥ 0.0.0-20250114093457-36d6fad421fb`	`0.0.0-20250521183405-c7a690348df7`

概要

Impact:

Viewers can view all dashboards/folders regardless of permissions
Editors can view/edit/delete all dashboards/folders regardless of permissions
Editors can create dashboards in any folder regardless of permissions
Anonymous users with viewer/editor roles are similarly affected

Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.

NVD の説明

A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1). Impact: - Viewers can view all dashboards/folders regardless of permissions - Editors can view/edit/delete all dashboards/folders regardless of permissions - Editors can create dashboards in any folder regardless of permissions - Anonymous users with viewer/editor roles are similarly affected Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.