Grafana Labs 10.4.x < 10.4.19

CVE-2025-3580 is an improper access control flaw in Grafana's DELETE /api/org/users/ endpoint that allows an Organization Administrator to permanently delete the Server Administrator account from the system. The bug has existed since Grafana v5.4.0 and affects every release branch up through 12.0.0. The deletion is irreversible through the UI — if the only Server Admin is removed, the entire Grafana instance loses its super-user and becomes unmanageable until someone intervenes directly in the backing database. Fixed versions are 10.4.19, 11.2.10, 11.3.7, 11.4.5, 11.5.5, 11.6.2, and 12.0.1.

Grafana's vendor MEDIUM (CVSS 5.5) is *slightly generous* but directionally correct. The PR:H requirement means the attacker must already hold Organization Admin privileges — a trusted insider role in most deployments. There is no code execution, no data exfiltration, and no lateral movement. The impact is purely availability of admin functions; dashboards, alerting rules, and data sources continue to operate normally. The instance is recoverable via direct database manipulation (UPDATE user SET is_admin=1 WHERE ...). No public PoC exists, EPSS sits at the 39th percentile, and there is zero evidence of in-the-wild exploitation. The noisgate reassessed score is 4.5 — a slight downgrade reflecting the insider-only attack surface and full recoverability.

1. Create a dedicated organization for all Server Admin accounts — Grafana's own recommended mitigation. If every Server Admin belongs to at least one org that no untrusted Org Admin controls, the deletion path is blocked entirely. This is a zero-cost configuration change that should be deployed immediately as the primary compensating control. No noisgate mitigation SLA applies to MEDIUM findings — go straight to the 365-day remediation window.
2. Ensure multiple Server Admin accounts exist — Maintain at least two Server Admin accounts (ideally a break-glass service account stored in your PAM vault). Even if one is deleted, the other retains full control. This is defense-in-depth against any single-point-of-failure in Grafana admin access.
3. Monitor Grafana audit logs for user deletion events — Alert on user.deleted events in Grafana's audit log, especially when the deleted user had isGrafanaAdmin: true. Forward these to your SIEM with a P2 alert rule. This provides detection-in-depth even if the configuration controls above are missed.
4. Restrict Org Admin role grants via SSO/SAML role mapping — If Grafana is backed by SAML/OIDC, enforce Org Admin assignment exclusively through IdP group membership rather than Grafana's internal role management. This prevents ad-hoc Org Admin grants and reduces the insider attack surface.
5. Upgrade to patched Grafana version within 365 days — Apply the vendor patch (10.4.19, 11.2.10, 11.3.7, 11.4.5, 11.5.5, 11.6.2, or 12.0.1+) per the noisgate remediation SLA for MEDIUM findings. The configuration mitigations above fully neutralize the attack path in the interim.

Run this script on the Grafana server host or any machine with curl access to the Grafana API. Requires a valid Grafana Server Admin API key or credentials. Example: bash check_cve_2025_3580.sh https://grafana.corp.local admin:secretpass

#!/usr/bin/env bash
# check_cve_2025_3580.sh — Detect CVE-2025-3580 (Grafana Org Admin Server Admin Deletion)
# Usage: bash check_cve_2025_3580.sh <GRAFANA_URL> <USER:PASS | api_key>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

GRAFANA_URL="${1:?Usage: $0 <GRAFANA_URL> <USER:PASS or api_key>}"
AUTH="${2:?Provide user:pass or API key}"

# Determine auth header
if [[ "$AUTH" == *:* ]]; then
  AUTH_HEADER="-u $AUTH"
else
  AUTH_HEADER="-H 'Authorization: Bearer $AUTH'"
fi

# Fetch Grafana version from health endpoint
VERSION=$(eval curl -sk $AUTH_HEADER "${GRAFANA_URL}/api/health" 2>/dev/null | grep -oP '"version"\s*:\s*"\K[0-9]+\.[0-9]+\.[0-9]+' || true)

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — could not determine Grafana version from ${GRAFANA_URL}/api/health"
  exit 2
fi

echo "Detected Grafana version: $VERSION"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

# Check against fixed versions
# Fixed: 10.4.19, 11.2.10, 11.3.7, 11.4.5, 11.5.5, 11.6.2, 12.0.1
VULN=0

if (( MAJOR < 10 )); then
  # Versions before 10 — affected if >= 5.4.0
  if (( MAJOR > 5 )) || { (( MAJOR == 5 )) && (( MINOR >= 4 )); }; then
    VULN=1
  fi
elif (( MAJOR == 10 )); then
  if (( MINOR == 4 )) && (( PATCH < 19 )); then
    VULN=1
  elif (( MINOR < 4 )); then
    VULN=1
  fi
elif (( MAJOR == 11 )); then
  if (( MINOR == 2 )) && (( PATCH < 10 )); then
    VULN=1
  elif (( MINOR == 3 )) && (( PATCH < 7 )); then
    VULN=1
  elif (( MINOR == 4 )) && (( PATCH < 5 )); then
    VULN=1
  elif (( MINOR == 5 )) && (( PATCH < 5 )); then
    VULN=1
  elif (( MINOR == 6 )) && (( PATCH < 2 )); then
    VULN=1
  elif (( MINOR < 2 )); then
    VULN=1
  fi
elif (( MAJOR == 12 )); then
  if (( MINOR == 0 )) && (( PATCH < 1 )); then
    VULN=1
  fi
elif (( MAJOR > 12 )); then
  VULN=0
fi

if (( VULN == 1 )); then
  echo "VULNERABLE — Grafana $VERSION is affected by CVE-2025-3580"
  echo "Upgrade to the nearest fixed version for your branch."
  exit 1
else
  echo "PATCHED — Grafana $VERSION is not affected by CVE-2025-3580"
  exit 0
fi

1. Tenable Plugin 241355
2. Grafana Security Advisory — CVE-2025-3580
3. Grafana Blog — Security Release for CVE-2025-4123 and CVE-2025-3580
4. Wiz Vulnerability Database — CVE-2025-3580
5. NVD — CVE-2025-3580
6. BleepingComputer — Grafana Exposure Analysis
7. CISA KEV Catalog