A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1). Impact: - Viewers can view all dashboards/folders regardless of permissions - Editors can view/edit/delete all dashboards/folders regardless of permissions - Editors can create dashboards in any folder regardless of permissions - Anonymous users with viewer/editor roles are similarly affected Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to     bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1,     v2alpha1). Impact: - Viewers can view all dashboards/folders regardless of permissions - Editors can     view/edit/delete all dashboards/folders regardless of permissions - Editors can create dashboards in any     folder regardless of permissions - Anonymous users with viewer/editor roles are similarly affected     Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does     not grant access to datasources. (CVE-2025-3260)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Grafana Labs installed on the remote host is affected by a vulnerability as referenced in the CVE-2025-3260 advisory. Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is
    able to modify such a panel in order to make it execute arbitrary JavaScript. (CVE-2025-2703)

  - A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to
    bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1,
    v2alpha1). Impact: - Viewers can view all dashboards/folders regardless of permissions - Editors can
    view/edit/delete all dashboards/folders regardless of permissions - Editors can create dashboards in any
    folder regardless of permissions - Anonymous users with viewer/editor roles are similarly affected
    Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does
    not grant access to datasources. (CVE-2025-3260)

  - This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding
    an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read
    access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects
    datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based
    datasources. (CVE-2025-3454)

ID	Name	Product	Family	Severity
250895	Linux Distros Unpatched Vulnerability : CVE-2025-3260	Nessus	Misc.	high
237905	Grafana Labs < 11.6.1+security-01 Authorization Bypass (CVE-2025-3260)	Nessus	Web Servers	medium
427783	Alpine: multiple grafana packages: security update to 11.6.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
427783	Alpine: multiple grafana packages: security update to 11.6.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high

Detections

Analytics

CVE-2025-3260

high

Tenable Plugins

high

medium

high

high