CVE-2025-41115 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Critical SCIM Privilege Escalation in Grafana Enterprise. 💥 **Consequences**: Attackers can impersonate users or escalate privileges to Admin level. CVSS Score: **10.0** (Critical).

Q: Who is affected? (Versions/Components)

🏢 **Affected**: **Grafana Enterprise** versions **12.x**. ⚙️ **Component**: Specifically the **SCIM user-provisioning** feature when enabled.

Q: What can hackers do? (Privileges/Data)

👑 **Hacker Actions**: 1. **Identity Impersonation**: Act as any user. 2. **Privilege Escalation**: Gain Admin rights. 3. **Full Control**: Read/Modify/Delete all dashboards & data (C:H, I:H, A:H).

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. 🔓 **Auth**: No authentication required (`PR:N`). 🌐 **Network**: Remote (`AV:N`). 🔧 **Config**: Requires `user_sync_enabled = true` in SCIM settings.

Q: Is there a public Exp? (PoC/Wild Exploitation)

💣 **Public Exp**: **YES**. Multiple PoCs available on GitHub (e.g., `Blackash-CVE-2025-41115`). 🔥 **Wild Exploitation**: High risk due to simplicity of sending a numeric `externalId`.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Check if running **Grafana Enterprise 12.x**. 2. Verify if **SCIM** is enabled. 3. Check config for `user_sync_enabled = true`. 4. Scan for SCIM endpoints accepting numeric IDs.

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: **YES**. Vendor advisory published on **2025-11-21**. 📥 **Action**: Update to the patched version immediately via Grafana Security Advisories.

Q: What if no patch? (Workaround)

🚧 **No Patch Workaround**: 1. **Disable SCIM** if not strictly needed. 2. Set `user_sync_enabled = false`. 3. Restrict SCIM client access via **Firewall/WAF** to trusted IPs only.

Q: Is it urgent? (Priority Suggestion)

🔴 **Urgency**: **CRITICAL / IMMEDIATE**. 📢 **Priority**: Patch immediately. CVSS 10.0 + Public Exploits = High likelihood of active attacks. Do not wait.

Updated May 06, 2026 CVSS 10.0 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Critical SCIM Privilege Escalation in Grafana Enterprise. <br>💥 **Consequences**: Attackers can impersonate users or escalate privileges to Admin level. CVSS Score: **10.0** (Critical).

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: Improper handling of user identity in **SCIM configuration**.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

🏢 **Affected**: **Grafana Enterprise** versions **12.x**. <br>⚙️ **Component**: Specifically the **SCIM user-provisioning** feature when enabled.

Q4What can hackers do? (Privileges/Data)

👑 **Hacker Actions**: <br>1. **Identity Impersonation**: Act as any user. <br>2. **Privilege Escalation**: Gain Admin rights. <br>3. **Full Control**: Read/Modify/Delete all dashboards & data (C:H, I:H, A:H).

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. <br>🔓 **Auth**: No authentication required (`PR:N`). <br>🌐 **Network**: Remote (`AV:N`). <br>🔧 **Config**: Requires `user_sync_enabled = true` in SCIM settings.

Q6Is there a public Exp? (PoC/Wild Exploitation)

💣 **Public Exp**: **YES**. Multiple PoCs available on GitHub (e.g., `Blackash-CVE-2025-41115`). <br>🔥 **Wild Exploitation**: High risk due to simplicity of sending a numeric `externalId`.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: <br>1. Check if running **Grafana Enterprise 12.x**. <br>2. Verify if **SCIM** is enabled. <br>3. Check config for `user_sync_enabled = true`. <br>4. Scan for SCIM endpoints accepting numeric IDs.

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: **YES**. Vendor advisory published on **2025-11-21**. <br>📥 **Action**: Update to the patched version immediately via Grafana Security Advisories.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: <br>1. **Disable SCIM** if not strictly needed. <br>2. Set `user_sync_enabled = false`. <br>3. Restrict SCIM client access via **Firewall/WAF** to trusted IPs only.

Q10Is it urgent? (Priority Suggestion)

🔴 **Urgency**: **CRITICAL / IMMEDIATE**. <br>📢 **Priority**: Patch immediately. CVSS 10.0 + Public Exploits = High likelihood of active attacks. Do not wait.

Continue exploring

Vulnerability detail Full AI analysis (login) Grafana