Grafana Labs has issued a warning regarding a maximum severity vulnerability, CVE-2025-41115, in its Grafana Enterprise product. This flaw can be exploited to treat new users as administrators or for privilege escalation within the platform.
SCIM Configuration Vulnerability
The issue is only exploitable when the SCIM (System for Cross domain Identity Management) provisioning feature is enabled and correctly configured. Specifically, both the enableSCIM feature flag and the user_sync_enabled option must be set to true.
When these conditions are met, a malicious or compromised SCIM client can provision a new user with a numeric externalId that maps directly to an existing internal account, including administrator accounts. The externalId is a SCIM bookkeeping attribute used by the identity provider to track users.
Because Grafana historically mapped this value directly to its internal user.uid, a numeric externalId such as "1" could be misinterpreted as an existing internal account. This enables an attacker to impersonate or escalate privileges to that account.
Affected Versions and Mitigation
Grafana, a widely used data visualization and monitoring platform, stated that this vulnerability impacts Grafana Enterprise versions between 12.0.0 and 12.2.1 when SCIM is enabled. Grafana OSS users are not impacted, and Grafana Cloud services have already received automatic patches.
Grafana Labs discovered the flaw during an internal audit on November 4, and a security update was released roughly 24 hours later. The company confirmed that there is no evidence of exploitation in the wild.
Administrators of self managed Grafana Enterprise installations are strongly urged to upgrade immediately to one of the following patched versions:
- Grafana Enterprise version 12.3.0
- Grafana Enterprise version 12.2.1
- Grafana Enterprise version 12.1.3
- Grafana Enterprise version 12.0.6
Alternatively, administrators can mitigate the risk by changing the configuration to disable SCIM provisioning.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
