Grafana EUVD-2025-16627

The CVSS v3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) signals HIGH real-world risk: the attack requires network access (AV:N) and low privileges (PR:L—authenticated user), with no user interaction (UI:N) and low attack complexity (AC:L). The scope is unchanged (S:U), meaning impact is limited to the vulnerable component, not system-wide. High confidentiality (C:H) and integrity (I:H) impact reflects unauthorized data viewing and modification of dashboards; low availability (A:L) suggests potential disruption but not complete denial. Combined with the fact that authentication is required but minimal (any viewer/editor role), and the attack is trivial to execute (no complexity), this vulnerability poses CRITICAL priority in multi-tenant environments where dashboard segregation is a trust boundary. Organizations deploying Grafana with role-based dashboard isolation should treat this as active remediation candidate. The lack of mentioned EPSS score, KEV listing, or public POC in the provided data prevents full real-world exploitation assessment, but the straightforward nature of API-level authorization bypass suggests proof-of-concept development would be trivial for skilled attackers.

An attacker with a valid Grafana viewer account (low-privilege, easily obtainable in organizations with open registration) authenticates to the Grafana instance and makes direct REST API calls to /apis/dashboard.grafana.app/v1alpha1/dashboards or /apis/dashboard.grafana.app/v1alpha1/folders endpoints. The attacker can enumerate all dashboards and folders by listing resources without explicit permission checks enforcing the expected viewer restrictions. Using GET requests, the attacker retrieves dashboards containing sensitive metrics, configuration data, or business intelligence that should be restricted to specific teams or roles. If the attacker escalates to an editor role (either through privilege escalation, social engineering, or a second compromised account), they can DELETE critical dashboards, MODIFY monitoring rules embedded in dashboards, or CREATE new dashboards in restricted folders to inject malicious monitoring rules or exfiltrate data through dashboard queries. No user interaction is required; the attack is fully automated via API. In a multi-tenant SaaS Grafana deployment, this allows cross-tenant dashboard access if multiple organizations share the same instance with role-based isolation expectations.