Grafana -- User deletion issue

2025-05-23 · CVE-2025-3580 · VuXML entry

Grafana Labs reports: On April 15, we discovered a vulnerability that stems from the user deletion logic associated with organization administrators. An organization admin could remove any user from the specific organization they manage. Additionally, they have the power to delete users entirely from the system if they have no other org membership. This leads to two situations: They can delete a server admin if the …

Affected versions

• grafana >= 5.4.0 < 10.4.18+security-01; >= 11.0.0 < 11.2.9+security-01; >= 11.3.0 < 11.3.6+security-01; >= 11.4.0 < 11.4.4+security-01; >= 11.5.0 < 11.5.4+security-01; >= 11.6.0 < 11.6.1+security-01; >= 12.0.0 < 12.0.0+security-01
• grafana8 >= 8.0.0
• grafana9 >= 9.0.0

By system

1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.