CVE-2025-41116
BaseFortify
Publication date: 2025-11-11
Last updated on: 2025-11-19
Assigner: Grafana Labs
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| grafana | databricks_datasource_plugin | 1.6.0 |
| grafana | databricks_datasource_plugin | 1.12.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-653 | The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Grafana Databricks Datasource Plugin when OAuth passthrough is enabled and multiple users access the same datasource simultaneously on a single Grafana instance. It can cause the wrong user identifier to be used, leading to information being returned to a viewer who is not authorized to see it.
How can this vulnerability impact me? :
The vulnerability can result in unauthorized access to information because the system may return data associated with the wrong user. This means sensitive or private information could be exposed to users who should not have access to it.