IT Consultancy
IT Consultancy Get expert guidance to leverage technology for your business growth. We help you identify the right IT solutions, optimize infrastructure, and ensure your digital environment is secure,…
Grafana Releases Critical Security Update to Patch CVE-2025-41115
Digital Marketing
Digital Marketing Grow your brand and reach the right audience with data-driven marketing strategies. We help you create campaigns that convert, manage social channels effectively, and optimize your d…
Privacy Policy
Privacy Policy At CometSoul, accessible from https://cometsoul.com, one of our main priorities is the privacy of our visitors. This Privacy Policy document contains types of information that is collec…
Terms and Conditions
Welcome to CometSoul! These terms and conditions outline the rules and regulations for the use of CometSoul’s Website, located at https://cometsoul.com. By accessing this website we assume you a…
Disclaimer
If you require any more information or have any questions about our site’s disclaimer, please feel free to contact us. Disclaimers for CometSoul All the information on this website – https…
Managed Wi-Fi Service
Managed Wi-Fi Service Build a fast, stable, and secure Wi-Fi for your business at Zero depreciation cost. Enterprise-Grade Guest Wi-Fi With $0 Upfront Hardware Costs. We provide, install, and support …
Smart Business System Integrator
Smart Business System Integrator Simplify your daily operations with smart systems that automate bookings, schedules, and routine tasks so you can focus on growing your business. We set up and integra…
IT Procurement & Hardware Managed Service
IT Procurement & Hardware Managed Service Keep your technology running smoothly from the hardware you use every day to the systems that power your business. We provide end-to-end IT management so …
Grafana has released an important security update to fix a critical vulnerability that could allow attackers to escalate privileges or even take over user accounts. Because of the high severity, the company strongly recommends all administrators apply the update immediately.
CVE-2025-41115: A Critical Vulnerability With CVSS 10.0
The vulnerability is tracked as CVE-2025-41115 and carries a CVSS score of 10.0, the highest possible rating in the risk scoring system.
Root Cause: SCIM Module
The issue originates from the System for Cross-domain Identity Management (SCIM) module. This feature is used to automatically manage and synchronize user accounts. SCIM was introduced in April 2025 and is still in public preview.
Grafana explains that the vulnerability appears when SCIM is enabled. Under certain conditions, a malicious SCIM client can create a user account with an externalId value set to a number. This allows the attacker to override an internal identity and assume the privileges of another user.
Conditions Required for Exploitation
The vulnerability can only be exploited if both of the following configuration settings are enabled:
enableSCIM = trueuser_sync_enabled = truein the[auth.scim]block
If either setting is disabled, the attack cannot be carried out.
Affected Grafana Versions
This flaw affects Grafana Enterprise versions:
- 12.0.0 to 12.2.1
Patched Versions
Grafana has released fixes in the following versions:
- 12.0.6+security-01
- 12.1.3+security-01
- 12.2.1+security-01
- 12.3.0
Internally Discovered Vulnerability
Grafana discovered the issue on November 4, 2025, during an internal security audit. Due to the extremely high risk, users are urged to update their installations without delay.
Recommended Actions
To prevent misuse, administrators should:
- Check their running Grafana Enterprise version
- Update immediately if they are using an affected version
- Review SCIM configuration settings
- Ensure administrator accounts are secure and monitored
Source: https://thehackernews.com/2025/11/grafana-patches-cvss-100-scim-flaw.html