Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Grafana Enterprise max-severity SCIM privilege-escalation flaw (CVE-2025-41115)

Vulnerability
First reported
Last updated
Happening score
H score 29
1 unique sources, 1 articles

Summary

Hide ▲

A max-severity flaw in Grafana Enterprise lets a malicious or compromised SCIM client turn new users into administrators or map them to existing internal accounts, creating immediate privilege-escalation risk. The issue is tracked as CVE-2025-41115 and affects versions 12.0.0 through 12.2.1 when enableSCIM and user_sync_enabled are both enabled. Grafana Cloud services were already patched, and Grafana OSS is not impacted. Self-managed operators are advised to upgrade to a patched release or disable SCIM to close the attack path.

Related Happenings

Grafana Labs Says GitHub hit by cyberattack

Incident
H score70 First: 17.05.2026 10:13 Last: 17.05.2026 10:13 Sources 1

About this happening: A Grafana Labs incident was later tied to the Mini Shai-Hulud supply-chain campaign against TanStack npm packages. Grafana said an unauthorized party used a token to a...

Open Happening

Grafana indirect prompt injection GrafanaGhost security flaw

Vulnerability
H score27 First: 07.04.2026 22:52 Last: 07.04.2026 22:52 Sources 1

About this happening: Grafana's AI components had an indirect prompt injection flaw, GrafanaGhost, that could let attackers exfiltrate sensitive data from user-visible content and s...

Open Happening

BeyondTrust Remote Support and Privileged Remote Access CVE-2026-1731 active exploitation wave

Exploitation Wave
H score76 First: 12.02.2026 23:34 Last: 12.02.2026 23:34 Sources 1

About this happening: CVE-2026-1731 in BeyondTrust Remote Support and Privileged Remote Access is now seeing first in-the-wild exploitation, putting exposed appliances at risk of remote...

Open Happening

Timeline

  1. 21.11.2025 19:58 1 articles · 7mo ago

    Grafana Enterprise flaw found during internal auditing

    Technical Analysis Update

    Grafana Labs discovered CVE-2025-41115 during internal auditing of Grafana Enterprise on November 4, identifying a SCIM provisioning flaw that could let a malicious or compromised SCIM client make new users appear as administrators or gain privilege escalation when enableSCIM and user_sync_enabled are both true.

    Show sources
    Open in new tab
  2. 21.11.2025 19:58 2 articles · 7mo ago

    Grafana Labs publicly releases CVE-2025-41115 bulletin

    Initial Disclosure

    Grafana Labs publicly released the security update and accompanying bulletin for CVE-2025-41115 on November 19, with patched Grafana Enterprise versions 12.3.0, 12.2.1, 12.1.3, and 12.0.6 available and guidance to upgrade or disable SCIM to reduce exploitation risk.

    Show sources
    Open in new tab