Grafana vulnerable to authenticated users bypassing dashboard, folder permissions

CAO 8.3CVE-2025-3260 · BIT-grafana-2025-3260 · GHSA-3px7-c4j3-576r · Công bố 02/06/2025 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2025-3260 là lỗ hổng mức CAO (CVSS 8.3) ảnh hưởng github.com/grafana/grafana.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.56%, cao hơn 46.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.0.0-20250521183405-c7a690348df7 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/grafana/grafana Go	`≥ 0.0.0-20250114093457-36d6fad421fb, < 0.0.0-20250521183405-c7a690348df7≥ 0.0.0-20250114093457-36d6fad421fb`	`0.0.0-20250521183405-c7a690348df7`

Mô tả

Impact:

Viewers can view all dashboards/folders regardless of permissions
Editors can view/edit/delete all dashboards/folders regardless of permissions
Editors can create dashboards in any folder regardless of permissions
Anonymous users with viewer/editor roles are similarly affected

Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.

Mô tả của NVD

A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1). Impact: - Viewers can view all dashboards/folders regardless of permissions - Editors can view/edit/delete all dashboards/folders regardless of permissions - Editors can create dashboards in any folder regardless of permissions - Anonymous users with viewer/editor roles are similarly affected Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.