Improper access control in Grafana - CVE-2025-3580
Published: May 27, 2025
Vulnerability identifier: #VU109851
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-3580
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in Grafana OSS. An organization administrator can permanently delete the Server administrator account via HTTP DELETE request to the "/api/org/users/" endpoint.
Affected software
Grafana
How to mitigate CVE-2025-3580
Install updates from vendor's website.
Grafana - addressed in versions 10.4.19, 11.2.10, 11.3.7, 11.4.5, 11.5.5, 11.6.2, 12.0.1