Grafana Patches CVSS 10.0 SCIM Flaw Enabling Impersonation and Privilege Escalation

Grafana has patched a high‑severity flaw in its SCIM provisioning component, tracked as CVE-2025-41115, which carries a CVSS score of 10.0 and could enable impersonation or privilege escalation under certain configurations. The issue arises in Grafana Enterprise versions 12.0.0 to 12.2.1, where SCIM provisioning is enabled and a vulnerability in user identity handling could allow a malicious or compromised SCIM client to provision a user with a numeric externalId, potentially overriding internal user IDs.

Exploitation hinges on two conditions being met: the enableSCIM feature flag is true and the user_sync_enabled option in the auth[.]scim block is true, with Grafana mapping externalId directly to internal user[.]uid. The flaws were discovered internally on 4 November 2025 during an audit and testing, and Grafana has released patches in Grafana Enterprise 12.0.6+security-01, 12.1.3+security-01, 12.2.1+security-01, and 12.3.0, according to Grafana.

The vendor notes that SCIM provisioning was introduced in April 2025 and is currently in public preview, and Grafana’s Vardan Torosyan emphasised that numeric externalIds could in specific cases cause a newly provisioned user to be treated as an existing internal account, such as Admin, enabling impersonation or privilege escalation, according to Grafana. Given the severity, users are urged to apply the patches promptly to mitigate potential risks.