CVE-2025-3580 (GCVE-0-2025-3580)

Vulnerability from cvelistv5 – Published: 2025-05-23 13:44 – Updated: 2025-07-17 10:28
VLAI?
Summary
An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator exists 2. The Server administrator is either: - Not part of any organization, or - Part of the same organization as the Organization administrator Impact: - Organization administrators can permanently delete Server administrator accounts - If the only Server administrator is deleted, the Grafana instance becomes unmanageable - No super-user permissions remain in the system - Affects all users, organizations, and teams managed in the instance The vulnerability is particularly serious as it can lead to a complete loss of administrative control over the Grafana instance.
Severity ?
5.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
CWE
Assigner
References
Impacted products
Vendor Product Version
Grafana Grafana Affected: 12.0.0 , < 12.0.1 (semver)
Affected: 11.6.1 , < 11.6.2 (semver)
Affected: 11.5.4 , < 11.5.5 (semver)
Affected: 11.4.4 , < 11.4.5 (semver)
Affected: 11.3.6 , < 11.3.7 (semver)
Affected: 11.2.9 , < 11.2.10 (semver)
Affected: 10.4.18 , < 10.4.19 (semver)
Create a notification for this product.
Credits
Saket Pandey
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3580",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-23T14:04:27.385036Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-23T14:05:09.480Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "12.0.1",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.6.2",
              "status": "affected",
              "version": "11.6.1",
              "versionType": "semver"
            },
            {
              "lessThan": "11.5.5",
              "status": "affected",
              "version": "11.5.4",
              "versionType": "semver"
            },
            {
              "lessThan": "11.4.5",
              "status": "affected",
              "version": "11.4.4",
              "versionType": "semver"
            },
            {
              "lessThan": "11.3.7",
              "status": "affected",
              "version": "11.3.6",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.10",
              "status": "affected",
              "version": "11.2.9",
              "versionType": "semver"
            },
            {
              "lessThan": "10.4.19",
              "status": "affected",
              "version": "10.4.18",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Saket Pandey"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint.\u003c/p\u003e\u003cp\u003eThe vulnerability can be exploited when:\u003c/p\u003e\u003cp\u003e1. An Organization administrator exists\u003c/p\u003e\u003cp\u003e2. The Server administrator is either:\u003c/p\u003e\u003ccode\u003e   - Not part of any organization, or\u003c/code\u003e\u003cbr\u003e\u003ccode\u003e   - Part of the same organization as the Organization administrator\u003c/code\u003e\u003cbr\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Organization administrators can permanently delete Server administrator accounts\u003c/p\u003e\u003cp\u003e- If the only Server administrator is deleted, the Grafana instance becomes unmanageable\u003c/p\u003e\u003cp\u003e- No super-user permissions remain in the system\u003c/p\u003e\u003cp\u003e- Affects all users, organizations, and teams managed in the instance\u003c/p\u003e\u003cp\u003eThe vulnerability is particularly serious as it can lead to a complete loss of administrative control over the Grafana instance.\u003c/p\u003e"
            }
          ],
          "value": "An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint.\n\nThe vulnerability can be exploited when:\n\n1. An Organization administrator exists\n\n2. The Server administrator is either:\n\n   - Not part of any organization, or\n   - Part of the same organization as the Organization administrator\nImpact:\n\n- Organization administrators can permanently delete Server administrator accounts\n\n- If the only Server administrator is deleted, the Grafana instance becomes unmanageable\n\n- No super-user permissions remain in the system\n\n- Affects all users, organizations, and teams managed in the instance\n\nThe vulnerability is particularly serious as it can lead to a complete loss of administrative control over the Grafana instance."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-17T10:28:18.011Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2025-3580/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2025-3580",
    "datePublished": "2025-05-23T13:44:45.974Z",
    "dateReserved": "2025-04-14T10:36:24.956Z",
    "dateUpdated": "2025-07-17T10:28:18.011Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-3580\",\"sourceIdentifier\":\"security@grafana.com\",\"published\":\"2025-05-23T14:15:28.740\",\"lastModified\":\"2025-05-23T15:54:42.643\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint.\\n\\nThe vulnerability can be exploited when:\\n\\n1. An Organization administrator exists\\n\\n2. The Server administrator is either:\\n\\n   - Not part of any organization, or\\n   - Part of the same organization as the Organization administrator\\nImpact:\\n\\n- Organization administrators can permanently delete Server administrator accounts\\n\\n- If the only Server administrator is deleted, the Grafana instance becomes unmanageable\\n\\n- No super-user permissions remain in the system\\n\\n- Affects all users, organizations, and teams managed in the instance\\n\\nThe vulnerability is particularly serious as it can lead to a complete loss of administrative control over the Grafana instance.\"},{\"lang\":\"es\",\"value\":\"Se descubri\u00f3 una vulnerabilidad de control de acceso en Grafana OSS donde un administrador de la organizaci\u00f3n podr\u00eda eliminar permanentemente la cuenta del administrador del servidor. Esta vulnerabilidad existe en el endpoint DELETE /api/org/users/. La vulnerabilidad se puede explotar cuando: 1. Existe un administrador de la organizaci\u00f3n 2. El administrador del servidor es: - No forma parte de ninguna organizaci\u00f3n, o - Forma parte de la misma organizaci\u00f3n que el administrador de la organizaci\u00f3n Impacto: - Los administradores de la organizaci\u00f3n pueden eliminar permanentemente las cuentas del administrador del servidor - Si se elimina el \u00fanico administrador del servidor, la instancia de Grafana se vuelve inadministrable - No quedan permisos de superusuario en el sistema - Afecta a todos los usuarios, organizaciones y equipos administrados en la instancia La vulnerabilidad es particularmente grave, ya que puede llevar a una p\u00e9rdida total del control administrativo sobre la instancia de Grafana.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@grafana.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":4.2}]},\"weaknesses\":[{\"source\":\"security@grafana.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"references\":[{\"url\":\"https://grafana.com/security/security-advisories/cve-2025-3580/\",\"source\":\"security@grafana.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-3580\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-23T14:04:27.385036Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-23T14:04:57.480Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Saket Pandey\"}], \"impacts\": [{\"capecId\": \"CAPEC-180\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-180\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Grafana\", \"product\": \"Grafana\", \"versions\": [{\"status\": \"affected\", \"version\": \"12.0.0\", \"lessThan\": \"12.0.1\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"11.6.1\", \"lessThan\": \"11.6.2\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"11.5.4\", \"lessThan\": \"11.5.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"11.4.4\", \"lessThan\": \"11.4.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"11.3.6\", \"lessThan\": \"11.3.7\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"11.2.9\", \"lessThan\": \"11.2.10\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"10.4.18\", \"lessThan\": \"10.4.19\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://grafana.com/security/security-advisories/cve-2025-3580/\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint.\\n\\nThe vulnerability can be exploited when:\\n\\n1. An Organization administrator exists\\n\\n2. The Server administrator is either:\\n\\n   - Not part of any organization, or\\n   - Part of the same organization as the Organization administrator\\nImpact:\\n\\n- Organization administrators can permanently delete Server administrator accounts\\n\\n- If the only Server administrator is deleted, the Grafana instance becomes unmanageable\\n\\n- No super-user permissions remain in the system\\n\\n- Affects all users, organizations, and teams managed in the instance\\n\\nThe vulnerability is particularly serious as it can lead to a complete loss of administrative control over the Grafana instance.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAn access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint.\u003c/p\u003e\u003cp\u003eThe vulnerability can be exploited when:\u003c/p\u003e\u003cp\u003e1. An Organization administrator exists\u003c/p\u003e\u003cp\u003e2. The Server administrator is either:\u003c/p\u003e\u003ccode\u003e   - Not part of any organization, or\u003c/code\u003e\u003cbr\u003e\u003ccode\u003e   - Part of the same organization as the Organization administrator\u003c/code\u003e\u003cbr\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Organization administrators can permanently delete Server administrator accounts\u003c/p\u003e\u003cp\u003e- If the only Server administrator is deleted, the Grafana instance becomes unmanageable\u003c/p\u003e\u003cp\u003e- No super-user permissions remain in the system\u003c/p\u003e\u003cp\u003e- Affects all users, organizations, and teams managed in the instance\u003c/p\u003e\u003cp\u003eThe vulnerability is particularly serious as it can lead to a complete loss of administrative control over the Grafana instance.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-284\", \"description\": \"CWE-284\"}]}], \"providerMetadata\": {\"orgId\": \"57da9224-a3e2-4646-9d0e-c4dc2e05e7da\", \"shortName\": \"GRAFANA\", \"dateUpdated\": \"2025-07-17T10:28:18.011Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-3580\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-07-17T10:28:18.011Z\", \"dateReserved\": \"2025-04-14T10:36:24.956Z\", \"assignerOrgId\": \"57da9224-a3e2-4646-9d0e-c4dc2e05e7da\", \"datePublished\": \"2025-05-23T13:44:45.974Z\", \"assignerShortName\": \"GRAFANA\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.