{"id":"CVE-2025-3260","published":"2025-06-02T10:06:39Z","modified":"2026-02-26T18:27:45Z","title":"A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard…","vendor":"Grafana","product":"Grafana","tier":"tail","description":{"text":"A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).\n\nImpact:\n\n- Viewers can view all dashboards/folders regardless of permissions\n\n- Editors can view/edit/delete all dashboards/folders regardless of permissions\n\n- Editors can create dashboards in any folder regardless of permissions\n\n- Anonymous users with viewer/editor roles are similarly affected\n\nOrganization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.3,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0056,"percentile":0.46551,"provenance":"source"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://grafana.com/security/security-advisories/CVE-2025-3260/","tags":[]}],"priority":{"score":15.1,"factors":[{"name":"EPSS percentile","points":9.31},{"name":"CVSS severity","points":5.81}]},"vendorSlug":"grafana","affectedVersions":[{"vendor":"Grafana","product":"Grafana","versions":[">= 11.6.0, < 11.6.1+security-01"]}],"affected":[{"ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=0.0.0-20250114093457-36d6fad421fb, <0.0.0-20250521183405-c7a690348df7",">=0.0.0-20250114093457-36d6fad421fb"],"patched":["0.0.0-20250521183405-c7a690348df7"],"from":["GHSA-3px7-c4j3-576r","GO-2025-3740"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-16627","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2025-3454","published":"2025-06-02","fixed":"0.0.0-20250424191517-1f707d16ed5d","kev":false,"link":{"from":"CVE-2025-3454","to":"CVE-2025-3260","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"0.0.0-20250424191517-1f707d16ed5d","toFixed":"0.0.0-20250521183405-c7a690348df7","daysApart":0}]}},{"cve":"CVE-2025-3260","published":"2025-06-02","fixed":"0.0.0-20250521183405-c7a690348df7","kev":false},{"cve":"CVE-2025-4123","published":"2025-05-22","fixed":"0.0.0-20250521183405-c7a690348df7","kev":false},{"cve":"CVE-2025-3415","published":"2025-07-17","fixed":"1.9.2-0.20250514160932-04111e9f2afd","kev":false},{"cve":"CVE-2025-6023","published":"2025-07-18","fixed":"1.9.2-0.20250521205822-0ba0b99665a9","kev":false},{"cve":"CVE-2025-1088","published":"2025-06-18","fixed":"11.6.2","kev":false,"link":{"from":"CVE-2025-3260","to":"CVE-2025-1088","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"0.0.0-20250521183405-c7a690348df7","toFixed":"0.0.0-20250521211231-e0ba4b480954","daysApart":16}]}}],"package":"Go:github.com/grafana/grafana"}}