CVE-2025-3580: Grafana OSS Auth Bypass Vulnerability

CVE-2025-3580 Overview

CVE-2025-3580 is an access control vulnerability in Grafana OSS. An Organization administrator can permanently delete the Server administrator account through the DELETE /api/org/users/ endpoint. The flaw maps to [CWE-284: Improper Access Control].

Exploitation requires an Organization administrator account and a Server administrator that either belongs to no organization or shares an organization with the attacker. Deleting the only Server administrator leaves the Grafana instance without any super-user, breaking administrative management of users, organizations, and teams.

Critical Impact
An Organization administrator can permanently remove the Server administrator, causing complete loss of administrative control over the Grafana instance.

Affected Products

Grafana OSS (Open Source)
Grafana Enterprise builds derived from affected OSS versions
Grafana instances where the Server administrator shares an organization with, or has no organization membership relative to, an Organization administrator

Discovery Timeline

2025-05-23 - CVE-2025-3580 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3580

Vulnerability Analysis

The vulnerability resides in the Grafana HTTP API endpoint DELETE /api/org/users/{userId}. This endpoint is designed to let Organization administrators remove users from an organization. The authorization logic fails to distinguish between removing an ordinary member and destroying a Server administrator identity.

When an Organization administrator invokes the endpoint against a user who also holds the Grafana Server administrator role, the request succeeds. The Server administrator account is permanently deleted rather than merely detached from the organization.

If the deleted account is the last remaining Server administrator, no user in the instance retains super-user permissions. Administrative operations that require Server administrator scope, including global user management, organization management, and instance-wide configuration through the API, become impossible.

Root Cause

The root cause is missing role validation on the target user during the delete operation. The endpoint enforces the caller's Organization administrator privilege but does not verify whether the target user holds a higher privilege scope. Grafana's role model treats Organization administrator and Server administrator as separate hierarchies, and this endpoint conflates organization-level removal with account-level deletion.

Attack Vector

An authenticated Organization administrator sends an HTTP DELETE request to /api/org/users/{serverAdminId} targeting the Server administrator's user ID. No user interaction from the victim is required. The action is network-reachable and requires high privileges but no social engineering. The result is deletion of the Server administrator account and, when it is the last one, an unmanageable Grafana instance.

Because no verified public exploit code has been published, the exploitation mechanism is described in prose only. See the Grafana Security Advisory CVE-2025-3580 for the vendor's technical description.

Detection Methods for CVE-2025-3580

Indicators of Compromise

Audit log entries showing successful DELETE /api/org/users/ requests where the target user held the Server administrator role
Sudden absence of any user with the GrafanaAdmin role in the user table or /api/admin/users output
Unexpected failures of automated jobs or integrations that authenticate as the Server administrator account
Organization administrator API tokens issuing user-deletion calls outside normal change windows

Detection Strategies

Parse Grafana access and audit logs for DELETE /api/org/users/ requests and correlate the target userId against known Server administrator identities
Alert when the count of users with isAdmin = true in Grafana drops, especially to zero
Baseline which Organization administrator identities normally perform user lifecycle operations and flag deviations

Monitoring Recommendations

Forward Grafana audit logs to a centralized log platform and retain them for privileged-action review
Monitor Grafana API tokens with Organization administrator scope for anomalous DELETE traffic
Track Server administrator account existence as a health metric alongside standard availability checks

How to Mitigate CVE-2025-3580

Immediate Actions Required

Upgrade Grafana OSS to a fixed version as documented in the Grafana Security Advisory CVE-2025-3580
Inventory all users holding the Server administrator role and confirm at least two accounts exist to prevent single-point loss
Review Organization administrator assignments and remove the role from accounts that do not require it
Rotate credentials and API tokens for any Organization administrator suspected of misuse

Patch Information

Grafana Labs has released fixed builds of Grafana OSS. Refer to the Grafana Security Advisory CVE-2025-3580 for the specific patched versions applicable to your deployment channel. Apply the update to all Grafana instances, including staging and disaster-recovery replicas.

Workarounds

Ensure the Server administrator account is not a member of any organization managed by lower-trust Organization administrators
Maintain a break-glass Server administrator account that is isolated from all organizations until upgrade is complete
Restrict network access to the Grafana admin API to trusted management networks while patching is scheduled

bash

# Verify Server administrators exist after remediation
curl -u admin:${GRAFANA_ADMIN_PASSWORD} \
  https://grafana.example.com/api/admin/users \
  | jq '[.[] | select(.isAdmin==true)] | length'