What is the CVSS score of CVE-2025-41115?

CVE-2025-41115 has a contested CVSS base score of 10.0 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Grafana are affected by CVE-2025-41115?

Organizations using SCIM provisioning face critical risk from CVE-2025-41115 rated CVSS 10.0.. A patch is available.

How to fix or mitigate CVE-2025-41115?

Within 7 days: Identify all affected systems running Grafana Enterprise and Grafana Cloud in April to improve how and apply vendor patches promptly. Monitor vendor channels for patch availability.

Grafana CVE-2025-41115

CRITICAL

Incorrect Privilege Assignment (CWE-266)

2025-11-21 security@grafana.com

Grafana Privilege Escalation Red Hat Suse

Critical

Disputed · 10.0 NVD

Severity by source

Sources disagree (Low–Critical)

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SUSE

3.1 LOW

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Red Hat

10.0 CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 19:23 vuln.today

CVE Published

Nov 21, 2025 - 15:15 nvd

CRITICAL 10.0

DescriptionCVE.org

SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.

In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation.

This vulnerability applies only if all of the following conditions are met:

enableSCIM feature flag set to true
user_sync_enabled config option in the [auth.scim] block set to true

AnalysisAI

SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-266. SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation. This vulnerability applies only if all of the following conditions are met: - enableSCIM feature flag set to true - user_sync_enabled config option in the [auth.scim] block set to true Affected products include: Grafana.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.