CVE-2025-41115 - CVE House
Back to Database
Status published Critical CVE-2025-41115

Incorrect privilege assignment

Vulnerability Description

SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation. This vulnerability applies only if all of the following conditions are met: - `enableSCIM` feature flag set to true - `user_sync_enabled` config option in the `[auth.scim]` block set to true

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-41115

Credits & Attribution

No credits recorded in the NVD database.

References

More from Grafana

View All →
CVE-2025-8341
SSRF in Infinity Datasource Plugin
Medium 5
CVE-2025-6197
An open redirect vulnerability has been identified in Grafana OSS...
Medium 4.2
CVE-2025-6023
An open redirect vulnerability has been identified in Grafana OSS...
High 7.6
CVE-2025-4123
A cross-site scripting (XSS) vulnerability exists in Grafana caused by...
High 7.6
CVE-2025-41118
Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection
Critical 9.1

Affected Vendor

Affected Software

Grafana Enterprise
Vulnerable Versions:
12.0.0

Timeline

Official Publish: November 21st, 2025
Last Modified: July 16th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.