CVE-2025-6197: An open redirect vulnerability has been identified in Grafana OSS organization switching functionality

Description

An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: - Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack vector

Network

Complexity

High

Privileges

None

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)70.1% · higher than 99% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

GR

Grafana · Grafana

12.0.x before 12.0.2+security-01; 11.6.x before 11.6.3+security-01; 11.5.x before 11.5.6+security-01; 11.4.x before 11.4.6+security-01; 11.3.x before 11.3.8+security-01 · source: vendor