How severe is CVE-2025-41115?

CVE-2025-41115 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-41115 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 17% (97th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-41115?

CVE-2025-41115 affects Grafana. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-41115?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-41115 have an EU (EUVD) identifier?

Yes. CVE-2025-41115 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-198492.

When was CVE-2025-41115 published?

CVE-2025-41115 was published on 2025-11-21 and last updated on 2026-06-17.

CVE-2025-41115

CVE-2025-41115 is a critical-severity vulnerability in Grafana with a CVSS 3.x base score of 10.0. Its EPSS exploit-prediction score of 17% places it in the 97th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-266.

Key facts

Severity: Critical (CVSS 3.x base score 10.0)
EPSS exploit prediction: 17% (97th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-198492
Weakness: CWE-266
Affected product: Grafana
Published: 2025-11-21
Last modified: 2026-06-17

Description

SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation. This vulnerability applies only if all of the following conditions are met: - `enableSCIM` feature flag set to true - `user_sync_enabled` config option in the `[auth.scim]` block set to true

Frequently asked questions

What is CVE-2025-41115?: SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation. This vulnerability applies only if all of the following conditions are met: - `enableSCIM` feature flag set to true - `user_sync_enabled` config option in the `[auth.scim]` block set to true
How severe is CVE-2025-41115?: CVE-2025-41115 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-41115 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 17% (97th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-41115?: CVE-2025-41115 affects Grafana. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-41115?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-41115 have an EU (EUVD) identifier?: Yes. CVE-2025-41115 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-198492.
When was CVE-2025-41115 published?: CVE-2025-41115 was published on 2025-11-21 and last updated on 2026-06-17.

References

https://grafana.com/security/security-advisories/cve-2025-41115

Affected products (1)

cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*

More vulnerabilities in Grafana

CVE-2024-9264 — Critical (CVSS 9.9): The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user…
CVE-2022-39328 — Critical (CVSS 9.8): Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4…
CVE-2022-28660 — Critical (CVSS 9.8): The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when…
CVE-2022-26148 — Critical (CVSS 9.8): An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the…
CVE-2021-39226 — Critical (CVSS 9.8): Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are…
CVE-2020-27846 — Critical (CVSS 9.8): A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML…

All CVEs affecting Grafana →

Other CWE-266 (Incorrect Privilege Assignment) vulnerabilities

CVE-2026-23800 — Critical (CVSS 10.0): Incorrect Privilege Assignment vulnerability in Modular DS modular-connector allows Privilege Escalation.This issue…
CVE-2024-9479 — Critical (CVSS 10.0): Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege…
CVE-2024-9478 — Critical (CVSS 10.0): Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege…
CVE-2026-42368 — Critical (CVSS 9.9): A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A…
CVE-2026-32922 — Critical (CVSS 9.9): OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with…
CVE-2026-22907 — Critical (CVSS 9.9): An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system…

Browse all CWE-266 (Incorrect Privilege Assignment) vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE:

196.188.187.85 (ipv4-addr)
52.140.76.154 (ipv4-addr)