Secuno
ENNL
Book demo

CVE-2025-41115

Grafana privilege escalation

10.0 CRITICALEPSS 16.9%
  1. Published21 Nov 2025

Description

SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation. This vulnerability applies only if all of the following conditions are met: - `enableSCIM` feature flag set to true - `user_sync_enabled` config option in the `[auth.scim]` block set to true

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Grafana≥ 12.0.0 < 12.2.1

Remediation

Fixed in
Grafana≥ 12.2.1

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-620229.8
Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1…
CVE-2026-398019.8
Subscriber Privilege Escalation in AIWU <= 1.5.9…
CVE-2026-963418.2
Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows…
CVE-2026-1066109.8
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification…
CVE-2026-955948.1
Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS…
CVE-2026-397758.8
Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2…

Frequently asked

Is CVE-2025-41115 being actively exploited?

CVE-2025-41115 is not in the CISA KEV catalog. Its EPSS exploit probability is 16.9%.

How severe is CVE-2025-41115?

CVE-2025-41115 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 16.9% probability of exploitation.

Which products are affected by CVE-2025-41115?

Affected products include Grafana.

How do I fix CVE-2025-41115?

Upgrade affected software to a fixed version, for example Grafana 12.2.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-41115 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.