5.5

CVE-2025-3580: grafana Improper Access Control

CVSS: 5.5v3.1MediumDeferred
AliasesUBUNTU-CVE-2025-3580
Published 23-05-2025Last modified 17-07-2025
Open JSON

Vulnerability summary

CVE-2025-3580 is a medium (CVSS 5.5) Improper Access Control vulnerability in grafana. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.3% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.48%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
OPENSUSE-SU-2025:15171-1SUSE-SU-2025:01985-1

Timeline

  1. 23-05-2025
    PublishedVulnerability first disclosed.
  2. 17-07-2025
    Last modifiedVulnerability information updated.

Description

An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator exists 2. The Server administrator is either: - Not part of any organization, or - Part of the same organization as the Organization administrator Impact: - Organization administrators can permanently delete Server administrator accounts - If the only Server administrator is deleted, the Grafana instance becomes unmanageable - No super-user permissions remain in the system - Affects all users, organizations, and teams managed in the instance The vulnerability is particularly serious as it can lead to a complete loss of administrative control over the Grafana instance.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.48%

Chance of exploitation in the next 30 days

Percentile

40%

Versus all other CVEs

30-day change

+0.02 pp

From 0.46% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.48%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Grafana1 product
  • grafana≥ 12.0.0, < 12.0.1 | ≥ 11.6.1, < 11.6.2 | ≥ 11.5.4, < 11.5.5 | ≥ 11.4.4, < 11.4.5 | ≥ 11.3.6, < 11.3.7 | ≥ 11.2.9, < 11.2.10 | ≥ 10.4.18, < 10.4.19
Ubuntu1 product
  • grafanaAll versions (No fix recorded)

2 vendors · 2 products

References

3 links