CVE-2025-41115
Description
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation. This vulnerability applies only if all of the following conditions are met: - `enableSCIM` feature flag set to true - `user_sync_enabled` config option in the `[auth.scim]` block set to true
How to fix
- grafana grafana12.2.1 or later
- github.com/grafana/grafana12.0.7, 12.1.4, 12.2.2, 1.9.2-0.20251106142618-ca5d89812015 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| grafana grafana | 12.0.0 ≤ v < 12.2.1 | 12.2.1 |
| github.com/grafana/grafanaGo | 12.0.0 ≤ v < 12.0.7, 12.1.0 ≤ v < 12.1.4, 12.2.0 ≤ v < 12.2.2, 1.9.2-0.20250310110405-e6fdb746f235 ≤ v < 1.9.2-0.20251106142618-ca5d89812015, 1.9.2-0.20250310110405-e6fdb746f235 ≤ v | 12.0.7, 12.1.4, 12.2.2, 1.9.2-0.20251106142618-ca5d89812015 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.