p PatchFirst

CVE-2025-3260

CVE-2025-3260

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1). Impact: - Viewers can view all dashboards/folders regardless of permissions - Editors can view/edit/delete all dashboards/folders regardless of permissions - Editors can create dashboards in any folder regardless of permissions - Anonymous users with viewer/editor roles are similarly affected Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.

CVSS 8.3 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system · applications

Affected products and versions

  • grafana

    Versions
    • ≥ 11.6.0, < 11.6.1+security-01: Affected (semver)

    Update to 11.6.1+security-01

  • grafana Ubuntu:16.04:LTS

    Versions
    • 2.6.0+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →