CVE-2025-3260 Grafana vulnerable to authenticated users bypassing dashboard, folder permissions
Authenticated users can bypass dashboard and folder permissions to view, edit, or delete resources they should not access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-3260?
CVE-2025-3260 is a high-severity missing authorization vulnerability in Grafana, published on 2 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).
Impact:
- Viewers can view all dashboards/folders regardless of permissions
- Editors can view/edit/delete all dashboards/folders regardless of permissions
- Editors can create dashboards in any folder regardless of permissions
- Anonymous users with viewer/editor roles are similarly affected
Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.
Weakness: CWE-863
Which versions are affected by CVE-2025-3260?
4 open source packages ship an affected version, including github.com/grafana/grafana and grafana.
| Package | Affected | Fixed in |
|---|---|---|
github.com/grafana/grafana Go | From 0.0.0-20250114093457-36d6fad421fb | None |
github.com/grafana/grafana Go | From 0.0.0-20250114093457-36d6fad421fb | 0.0.0-20250521183405-c7a690348df7 |
github.com/grafana/grafana Go | From 0.0.0-20250114093457-36d6fad421fb | 0.0.0-20250521183405-c7a690348df7 |
grafana Bitnami | From 11.6.0 | 11.6.1 |
How do I fix CVE-2025-3260?
Upgrade github.com/grafana/grafana to 0.0.0-20250521183405-c7a690348df7 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-3260 being exploited?
There is no known exploitation of CVE-2025-3260 in the wild and no public exploit code.
Sources
Also known as BIT-grafana-2025-3260, GHSA-3px7-c4j3-576r, GO-2025-3740, MINI-2hh9-6p5f-55rm, MINI-4973-8xfh-f74p, MINI-4h2w-6rwm-qcpr and 15 more.