Grafana has launched security updates to deal with a most severity security flaw that would permit privilege escalation or consumer impersonation below sure configurations.
The vulnerability, tracked as CVE-2025-41115, carries a CVSS rating of 10.0. It resides within the System for Cross-domain Identification Administration (SCIM) part that enables automated consumer provisioning and administration. First launched in April 2025, it is at present in public preview.
“In Grafana variations 12.x the place SCIM provisioning is enabled and configured, a vulnerability in consumer id dealing with permits a malicious or compromised SCIM consumer to provision a consumer with a numeric externalId, which in flip may permit for overriding inside consumer IDs and result in impersonation or privilege escalation,” Grafana’s Vardan Torosyan stated.
That stated, profitable exploitation hinges on each circumstances being met –
- enableSCIM function flag is about to true
- user_sync_enabled config choice within the [auth.scim] block is about to true
The shortcoming impacts Grafana Enterprise variations from 12.0.0 to 12.2.1. It has been addressed within the following variations of the software program –
- Grafana Enterprise 12.0.6+security-01
- Grafana Enterprise 12.1.3+security-01
- Grafana Enterprise 12.2.1+security-01
- Grafana Enterprise 12.3.0
“Grafana maps the SCIM externalId on to the interior consumer.uid; due to this fact, numeric values (e.g. ‘1’) could also be interpreted as inside numeric consumer IDs,” Torosyan stated. “In particular instances this might permit the newly provisioned consumer to be handled as an present inside account, such because the Admin, resulting in potential impersonation or privilege escalation.”
The analytics and observability platform stated the vulnerability was found internally on November 4, 2025, throughout an audit and testing. Given the severity of the difficulty, customers are suggested to use the patches as quickly as potential to mitigate potential dangers.
