CVE-2025-41115
Last modified
CVE-2025-41115 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation. This vulnerability applies only if all of the following conditions are met: - `enableSCIM` feature flag set to true - `user_sync_enabled` config option in the `[auth.scim]` block set to true. EPSS estimates a 17.29% chance of exploitation in the next 30 days.
Description
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation. This vulnerability applies only if all of the following conditions are met: - `enableSCIM` feature flag set to true - `user_sync_enabled` config option in the `[auth.scim]` block set to true
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana | >= 12.0.0, < 12.2.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-41115?
How severe is CVE-2025-41115?
How do I fix CVE-2025-41115?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-4111A vulnerability was found in PHPGurukul Pre-School Enrollmen…8.8
- CVE-2025-41110Encrypted WiFi and SSH credentials were found in the Ghost R…8.8
- CVE-2025-41111A lack of authorisation vulnerability has been detected in C…7.5
- CVE-2025-41112A lack of authorisation vulnerability has been detected in C…7.5
- CVE-2025-41113A lack of authorisation vulnerability has been detected in C…7.5
- CVE-2025-41114A lack of authorisation vulnerability has been detected in C…7.5
- CVE-2025-41116When using the Grafana Databricks Datasource Plugin, if Oaut…2.1
- CVE-2025-41117Stack traces in Grafana's Explore Traces view can be rendere…6.1
- CVE-2025-41118Pyroscope is an open-source continuous profiling database. T…9.1
- CVE-2025-4112A vulnerability was found in PHPGurukul Student Record Syste…9.8
- CVE-2025-4113A vulnerability was found in PHPGurukul Curfew e-Pass Manage…8.8
- CVE-2025-4114A vulnerability classified as critical has been found in Net…9.8
Are you affected by CVE-2025-41115?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST