GHSA-3px7-c4j3-576r
Grafana vulnerable to authenticated users bypassing dashboard, folder permissions
Quick fix
GHSA-3px7-c4j3-576r — github.com/grafana/grafana: upgrade to the fixed version with the command below.
go get github.com/grafana/grafana@v0.0.0-20250521183405-c7a690348df7Details
A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).
Impact:
- Viewers can view all dashboards/folders regardless of permissions
- Editors can view/edit/delete all dashboards/folders regardless of permissions
- Editors can create dashboards in any folder regardless of permissions
- Anonymous users with viewer/editor roles are similarly affected
Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.
Are you affected?
Enter the version of the package you're using.
Affected packages
0.0.0-20250114093457-36d6fad421fbFixed in: 0.0.0-20250521183405-c7a690348df7go get github.com/grafana/grafana@v0.0.0-20250521183405-c7a690348df7References
- https://nvd.nist.gov/vuln/detail/CVE-2025-3260[ADVISORY]
- https://github.com/grafana/grafana[PACKAGE]
- https://github.com/grafana/grafana/blob/be8d153dc33734caba4f617ff571d18253e68fa0/CHANGELOG.md#1161-2025-04-23[WEB]
- https://grafana.com/blog/2025/04/22/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-3260-cve-2025-2703-cve-2025-3454[WEB]
- https://grafana.com/security/security-advisories/CVE-2025-3260[WEB]