CVE-2025-3260

HIGH

Grafana vulnerable to authenticated users bypassing dashboard, folder permissions

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2025-3260 has a selected CVSS score of 8.3 (high).

Description

A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1). Impact: - Viewers can view all dashboards/folders regardless of permissions - Editors can view/edit/delete all dashboards/folders regardless of permissions - Editors can create dashboards in any folder regardless of permissions - Anonymous users with viewer/editor roles are similarly affected Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 28, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Grafana

Browse Grafana / Grafana
CVE List11.6.0 to < 11.6.1+security-01affected

github.com/grafana/grafana

Browse Go / github.com/grafana/grafana
GitHub Advisory0.0.0-20250114093457-36d6fad421fb to < 0.0.0-20250521183405-c7a690348df7 · Fixed in 0.0.0-20250521183405-c7a690348df7affected

References

5