{"id":"GO-2025-4153","revision":"3bfc71684ad44d0c9fe89c4a4def094e","records":[{"revision":"3bfc71684ad44d0c9fe89c4a4def094e","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-4153","aliases":["BIT-grafana-2025-41115","CVE-2025-41115","GHSA-w62r-7c53-fmc5"],"title":"Grafana Incorrect Privilege Assignment vulnerability in github.com/grafana/grafana","description":"Grafana Incorrect Privilege Assignment vulnerability in github.com/grafana/grafana.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20251106142618-ca5d89812015, from v12.0.0 before v12.0.7, from v12.1.0 before v12.1.4, from v12.2.0 before v12.2.2.","state":0,"publishedAt":"2025-11-25T18:12:18+00:00","modifiedAt":"2026-02-04T03:27:49.564564+00:00","affected":[{"ecosystem":"Go","name":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.9.2-0.20250310110405-e6fdb746f235"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/advisories/GHSA-w62r-7c53-fmc5","https://nvd.nist.gov/vuln/detail/CVE-2025-41115","https://github.com/grafana/grafana/commit/ca5d89812015ef2db3acc62826f73650450b331e","https://github.com/grafana/grafana/releases/tag/v12.0.7","https://github.com/grafana/grafana/releases/tag/v12.1.4","https://github.com/grafana/grafana/releases/tag/v12.2.2","https://github.com/grafana/grafana/releases/tag/v12.3.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-4153","license":"OSV · upstream source license applies","key":"osv:GO-2025-4153","identifiers":["GO-2025-4153","BIT-grafana-2025-41115","CVE-2025-41115","GHSA-w62r-7c53-fmc5"]},"retained":false,"historicalAffected":[]}],"coverage":[]}