Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-41115

CVE-2025-41115CRITICAL

Grafana Grafana Enterprise — Incorrect privilege assignment

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .1691   97.0     —

AFFECTED
  Product             Versions  Fixed
  Grafana Enterprise  12.0.0 –  —

TIMELINE
  Apr 16  Reserved by GRAFANA
  Nov 21  Published (CNA: GRAFANA)
  Oct 18  RESCORED — CVE-2025-41115 (Grafana Enterprise). CVSS 10 → 9.8 (NVD).

CWE-266 · CNA: GRAFANA · CVSS v3.1 · 1 reference · NVD status: Analyzed

Description

SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation. This vulnerability applies only if all of the following conditions are met: - `enableSCIM` feature flag set to true - `user_sync_enabled` config option in the `[auth.scim]` block set to true

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
April 16, 2025	Reserved	Reserved by GRAFANA
November 21, 2025	Published	Published (CNA: GRAFANA)
October 18, 2026	RESCORED	RESCORED — CVE-2025-41115 (Grafana Enterprise). CVSS 10 → 9.8 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Grafana	Grafana Enterprise	—	12.0.0	—

Weaknesses

CWE-266

References (1)

https://grafana.com/security/security-advisories/cve-2025-41115 [Broken Link]

Authoritative record: CVE-2025-41115 at cve.org

Vendors: grafana

Weaknesses: CWE-266

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-41115 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.