Grafana Patches Critical SCIM Flaw (CVE-2025-41115, CVSS 10) Allowing Privilege Escalation and User Impersonation

Grafana has issued emergency security updates for Grafana Enterprise to fix a critical SCIM vulnerability, tracked as CVE-2025-41115 with a maximum CVSS score of 10.0. The flaw arises from how SCIM user identities are processed, allowing a malicious or compromised SCIM client to provision a user with a numeric externalId that could override internal user IDs and lead to impersonation or privilege escalation, because externalId maps directly to internal user[.]uid.

Grafana says a value such as “1” could be interpreted as a valid internal ID, potentially enabling access to high-privilege accounts, and in certain cases could result in the newly provisioned user being treated as an existing internal account such as Admin. The vulnerability affects Grafana Enterprise versions 12.0.0 to 12.2.1, with patches released for 12.3.0, 12.2.1, 12.1.3 and 12.0.6; Grafana Cloud environments are already secured, and Grafana OSS users are not affected.

Administrators are urged to update promptly, and the advisory notes that the issue requires enableSCIM = true and user_sync_enabled = true under [auth[.]scim] for exploitation. 20 November 2025. According to Grafana, the patch is available in Enterprise 12.3 and backported releases.