CVE-2025-12141

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12141", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2025-10-24T07:07:00.941Z", "datePublished": "2026-04-15T14:59:41.317Z", "dateUpdated": "2026-04-15T18:45:53.672Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-04-15T14:59:41.317Z"}, "title": "Grafana Alerting Editors can edit destination of webhooks they did not create", "datePublic": "2025-12-16T20:56:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-200", "description": "CWE-200: Information Disclosure", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "affected": [{"vendor": "Grafana", "product": "Grafana Alerting", "repo": "https://github.com/grafana/grafana", "versions": [{"status": "affected", "version": "8.0.0", "lessThanOrEqual": "12.3.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions \u201calert.notifications:write\u201d or \u201calert.notifications.receivers:test\u201d that are granted as part of the fixed role \"Contact Point Writer\", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span>In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions \u201calert.notifications:write\u201d or \u201calert.notifications.receivers:test\u201d that are granted as part of the fixed role \"Contact Point Writer\", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.</span>"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2025-12141/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NEGLIGIBLE", "Automatable": "YES", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 1.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/S:N/AU:Y"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T18:45:45.527327Z", "id": "CVE-2025-12141", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T18:45:53.672Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12141", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T18:45:45.527327Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T18:45:49.143Z"}}], "cna": {"title": "Grafana Alerting Editors can edit destination of webhooks they did not create", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.3, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/S:N/AU:Y", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/grafana/grafana", "vendor": "Grafana", "product": "Grafana Alerting", "versions": [{"status": "affected", "version": "8.0.0", "versionType": "semver", "lessThanOrEqual": "12.3.0"}], "defaultStatus": "unaffected"}], "datePublic": "2025-12-16T20:56:00.000Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2025-12141/"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions \u201calert.notifications:write\u201d or \u201calert.notifications.receivers:test\u201d that are granted as part of the fixed role \"Contact Point Writer\", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.", "supportingMedia": [{"type": "text/html", "value": "<span>In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions \u201calert.notifications:write\u201d or \u201calert.notifications.receivers:test\u201d that are granted as part of the fixed role \"Contact Point Writer\", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Information Disclosure"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-04-15T14:59:41.317Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12141", "state": "PUBLISHED", "dateUpdated": "2026-04-15T18:45:53.672Z", "dateReserved": "2025-10-24T07:07:00.941Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-04-15T14:59:41.317Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana Alerting", "repo": "https://github.com/grafana/grafana", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.0", "status": "affected", "version": "8.0.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "matchCriteriaId": "1DDFD2FD-7573-4993-8C82-2DBA97D95956", "versionEndIncluding": "12.3.0", "versionStartIncluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions \u201calert.notifications:write\u201d or \u201calert.notifications.receivers:test\u201d that are granted as part of the fixed role \"Contact Point Writer\", which is part of the basic role Editor - can edit contact points created by other users, modify the endpoint URL to a controlled server. By invoking the test functionality, attackers can capture and extract redacted secure settings, such as authentication credentials for third-party services (e.g., Slack tokens). This leads to unauthorized access and potential compromise of external integrations."}, {"lang": "es", "value": "En el sistema de alertas de Grafana, los usuarios con permisos de edici\u00f3n para un punto de contacto, espec\u00edficamente los permisos 'alert.notifications:write' o 'alert.notifications.receivers:test' que se otorgan como parte del rol fijo 'Contact Point Writer', que forma parte del rol b\u00e1sico Editor - pueden editar puntos de contacto creados por otros usuarios, modificar la URL del endpoint a un servidor controlado. Al invocar la funcionalidad de prueba, los atacantes pueden capturar y extraer configuraciones seguras redactadas, como credenciales de autenticaci\u00f3n para servicios de terceros (p. ej., tokens de Slack). Esto conduce a acceso no autorizado y a la posible compromiso de integraciones externas."}], "id": "CVE-2025-12141", "lastModified": "2026-10-07T09:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@grafana.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12141", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T18:45:45.527327Z", "version": "2.0.3"}}]}, "published": "2026-04-15T16:16:33.040", "references": [{"source": "security@grafana.com", "tags": ["Vendor Advisory"], "url": "https://grafana.com/security/security-advisories/cve-2025-12141/"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@grafana.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Grafana: Grafana: Information disclosure of secure settings via contact point modification", "id": "2458704", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458704"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.0", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-266", "details": ["A flaw was found in Grafana's alerting system. Users with editor permissions, specifically those able to write or test alert notifications, can modify contact points created by other users. By changing the endpoint URL to a controlled server and triggering the test functionality, an attacker can capture and extract sensitive secure settings, such as authentication credentials for third-party services. This vulnerability leads to unauthorized access and potential compromise of external integrations."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, administrators should review and restrict user permissions within Grafana. Ensure that only trusted users are granted the \"Contact Point Writer\" role or any role that includes \"alert.notifications:write\" or \"alert.notifications.receivers:test\" permissions. Limiting the number of users with such elevated privileges reduces the attack surface. If the Grafana service is reconfigured, a restart may be required for changes to take effect."}, "name": "CVE-2025-12141", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:ceph_storage:5", "fix_state": "Fix deferred", "package_name": "rhceph/rhceph-5-dashboard-rhel8", "product_name": "Red Hat Ceph Storage 5"}, {"cpe": "cpe:/a:redhat:ceph_storage:6", "fix_state": "Fix deferred", "package_name": "rhceph/rhceph-6-dashboard-rhel9", "product_name": "Red Hat Ceph Storage 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-15T14:59:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-12141\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-12141\nhttps://grafana.com/security/security-advisories/cve-2025-12141/"], "statement": "This vulnerability has a Low impact on Red Hat products. The flaw in Grafana's alerting system allows an authenticated user with \"Contact Point Writer\" permissions (part of the Editor role) to disclose secure settings. Exploitation requires the attacker to modify an existing contact point and test it against a controlled external server.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,12.3.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Grafana Alerting", "source": "cna", "vendor": "Grafana"}, "product": "grafana", "vendor": "grafana"}], "analysis": {"en": {"generated_at": "2026-04-17T06:58:59.930431+00:00", "value": {"mitigation_remediation": ["Upgrade Grafana to a version that includes the alerting fix, following the vendor\u2019s advisory.", "Re\u2011evaluate the assignment of the Contact Point Writer role and remove \u2018alert.notifications:write\u2019 and \u2018alert.notifications.receivers:test\u2019 permissions from users who do not need them, applying a least\u2011privilege model.", "Monitor audit logs for changes to webhook destinations and payloads, and consider disabling the test functionality or restricting its use until the vulnerability is mitigated."], "summary": {"action": "Apply patch", "impact": "Unauthorized modification and extraction of external webhook credentials"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Grafana\u2019s Alerting component. Any instance where the Contact Point Writer role \u2013 part of the basic Editor role \u2013 is assigned to a user can be exploited. Because the issue is tied to permissions rather than a specific version, all Grafana installations using the default roles are potentially impacted until the patch is applied.", "description_and_impact": "Users granted edit rights to a Grafana contact point can change the destination of that alerting webhook, even if they did not create it. By using the test functionality, an attacker can trigger the webhook and capture redacted secure settings, such as third\u2011party service tokens. The result is that compromised or new credentials are exposed, allowing the attacker to access and potentially control external services like Slack or other integrations.", "risk_and_exploitability": "The CVSS score of 1.3 categorizes the flaw as low severity. No EPSS score is reported and the vulnerability is not listed in CISA\u2019s KEV catalog, implying a low likelihood of widespread exploitation at present. However, the attack vector is likely internal and requires legitimate edit permissions. Once an attacker gains the ability to alter contact points and trigger tests, they can exfiltrate confidential tokens, leading to unauthorized access to third\u2011party services."}}}}, "created": "2026-04-15T19:30:12.383924+00:00", "updated": "2026-04-17T07:00:08.571198+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana"]}