Grafana has launched safety updates to deal with a most severity safety flaw that would permit privilege escalation or person impersonation beneath sure configurations.
The vulnerability, tracked as CVE-2025-41115, carries a CVSS rating of 10.0. It resides within the System for Cross-domain Id Administration (SCIM) part that permits automated person provisioning and administration. First launched in April 2025, it is presently in public preview.
“In Grafana variations 12.x the place SCIM provisioning is enabled and configured, a vulnerability in person id dealing with permits a malicious or compromised SCIM consumer to provision a person with a numeric externalId, which in flip might permit for overriding inner person IDs and result in impersonation or privilege escalation,” Grafana’s Vardan Torosyan stated.
That stated, profitable exploitation hinges on each circumstances being met –
- enableSCIM function flag is ready to true
- user_sync_enabled config choice within the [auth.scim] block is ready to true
The shortcoming impacts Grafana Enterprise variations from 12.0.0 to 12.2.1. It has been addressed within the following variations of the software program –
- Grafana Enterprise 12.0.6+security-01
- Grafana Enterprise 12.1.3+security-01
- Grafana Enterprise 12.2.1+security-01
- Grafana Enterprise 12.3.0
“Grafana maps the SCIM externalId on to the inner person.uid; subsequently, numeric values (e.g. ‘1’) could also be interpreted as inner numeric person IDs,” Torosyan stated. “In particular instances this might permit the newly provisioned person to be handled as an current inner account, such because the Admin, resulting in potential impersonation or privilege escalation.”
The analytics and observability platform stated the vulnerability was found internally on November 4, 2025, throughout an audit and testing. Given the severity of the problem, customers are suggested to use the patches as quickly as doable to mitigate potential dangers.
