CVE-2025-41115: Incorrect privilege assignment
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.
In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation.
This vulnerability applies only if all of the following conditions are met: - enableSCIM feature flag set to true - usersyncenabled config option in the [auth.scim] block set to true
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/grafana/grafanato a version that resolves this vulnerability.Fixed in 1.9.2-0.20251106142618-ca5d89812015 - Upgrade
Upgrade
go/github.com/grafana/grafanato a version that resolves this vulnerability.Fixed in 12.2.2 - Upgrade
Upgrade
go/github.com/grafana/grafanato a version that resolves this vulnerability.Fixed in 12.1.4 - Upgrade
Upgrade
go/github.com/grafana/grafanato a version that resolves this vulnerability.Fixed in 12.0.7 - Configuration
Set the Grafana feature flag `enableSCIM` to false to disable SCIM provisioning and prevent malicious/compromised SCIM clients from provisioning users with numeric `externalId`.
Grafana SCIM provisioning enableSCIM = false - Configuration
In Grafana, in the `[auth.scim]` block set `user_sync_enabled` to false to disable SCIM user sync/provisioning and prevent externalId-based user identity override.
Grafana SCIM provisioning user_sync_enabled ([auth.scim]) = false
Event History
Frequently Asked Questions
What is the severity of CVE-2025-41115?
CVE-2025-41115 is considered to have a high severity due to its potential impact on user lifecycle management in Grafana.
How do I fix CVE-2025-41115?
To fix CVE-2025-41115, update your Grafana installation to the latest version that addresses this vulnerability.
Which versions of Grafana are affected by CVE-2025-41115?
CVE-2025-41115 affects Grafana versions 12.x where SCIM provisioning is enabled and configured.
What is the impact of CVE-2025-41115?
The impact of CVE-2025-41115 can include unauthorized access to user lifecycle management capabilities in Grafana.
Is SCIM provisioning safe to use in Grafana versions prior to 12.x?
Yes, SCIM provisioning is safe in Grafana versions prior to 12.x as CVE-2025-41115 specifically affects 12.x.