CVE-2025-3415: 
Grafana vulnerability analysis and mitigation

A vulnerability (CVE-2025-3415) was discovered in Grafana Alerting's DingDing contact-point integration. The vulnerability allows the integration URL to be exposed to users with viewer-level permissions. This security issue was disclosed on July 17, 2025, and affects multiple versions of Grafana (Grafana Labs, NVD).

The vulnerability is classified as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200). It has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility, low attack complexity, low privileges required, no user interaction needed, and low confidentiality impact (NVD).

The vulnerability could result in the exposure of sensitive DingDing integration URLs to users with viewer permissions, potentially compromising the confidentiality of alert notification configurations (Grafana Labs).

The vulnerability has been fixed in multiple Grafana versions including 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01, and 12.0.1+security-01. Users are advised to upgrade to these patched versions (Grafana Labs).