CVE-2025-6197

A flaw was found in Grafana, where the organization switching functionality caused an open redirect vulnerability. To make this exploitable, the Grafana instance must have more than one organization, and the user being redirected must be a member of both. Furthermore, the attacker needs to know the ID of the organization that the user is currently viewing.

This vulnerability is considered Low severity because its exploitation relies on very restrictive preconditions that significantly limit its real-world impact. The Grafana instance must have multiple organizations, the targeted user must be a member of both organizations, and the attacker must already know the exact organization ID that the user is currently viewing—information that is typically inaccessible without prior compromise or insider knowledge. Additionally, the flaw does not directly expose sensitive data or allow privilege escalation; it only enables an open redirect under tightly constrained circumstances.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.