Introduction
Privilege escalation in an enterprise observability platform can give an attacker unauthorized access to sensitive monitoring data and administrative controls. CVE-2025-41115 is a critical vulnerability in Grafana Enterprise's SCIM provisioning. It comes from a subtle flaw in identity mapping, and it hits organizations that rely on SCIM for automated user lifecycle management.
About Grafana Labs: Grafana Labs is a major vendor in observability and monitoring, and its flagship product, Grafana, is deployed by thousands of organizations worldwide. Grafana Enterprise adds advanced features for large-scale environments on top of the open-source platform, and Grafana Cloud is the company's managed service. Grafana has been adopted quickly in cloud-native and enterprise IT environments, so a security issue in its products reaches a large part of the tech industry.
Technical Information
CVE-2025-41115 affects Grafana Enterprise versions 12.0.0 through 12.2.1 when SCIM provisioning is enabled and configured. The root cause is how Grafana handles the SCIM externalId attribute during user provisioning. When a SCIM client provisions a user with a numeric externalId (for example, 1), Grafana may map that value directly to its internal user.uid field. That field is also numeric, and Grafana uses it as the primary key for user accounts. If the numeric externalId matches the ID of an internal privileged user (such as the administrator account, typically 1), Grafana may treat the newly provisioned user as that privileged account. The result is privilege escalation or user impersonation, because the attacker-controlled SCIM client in effect overrides the internal user mapping. The issue is classified as CWE-266 (Incorrect Privilege Assignment).
The vulnerability is exploitable only if both the enableSCIM feature flag and the user_sync_enabled option in the [auth.scim] configuration block are set to true. Grafana OSS is not affected. No public code snippets have been released for this vulnerability. Exploitation requires precise control of SCIM provisioning requests and knowledge of how internal user IDs are assigned.
Patch Information
Grafana Labs has released these patched versions of Grafana Enterprise:
- Grafana Enterprise 12.3.0, the latest release
- Grafana Enterprise 12.2.1, a backported release
- Grafana Enterprise 12.1.3, a backported release
- Grafana Enterprise 12.0.6
The patches fix how SCIM provisioning handles user identity. Before the fix, a malicious or compromised SCIM client could provision a user with a numeric externalId that overrode an internal user ID, which could lead to impersonation or privilege escalation.
The vulnerability affects Grafana Enterprise versions 12.0.0 through 12.2.1 when SCIM provisioning is enabled and configured. Grafana OSS users are not affected.
Grafana Cloud has been patched. Cloud providers licensed to offer Grafana Cloud Pro, such as Amazon Managed Grafana and Azure Managed Grafana, received early notification and have confirmed that their offerings were secure as of the announcement date.
We strongly recommend upgrading any affected Grafana Enterprise instance to one of the patched versions above. Upgrading mitigates the risk from CVE-2025-41115.
Patch source: Grafana Labs Security Advisory
Affected Systems and Versions
- Products: Grafana Enterprise (not OSS)
- Affected versions: 12.0.0 through 12.2.1
- Vulnerable configurations: Both the
enableSCIMfeature flag and theuser_sync_enabledoption in the[auth.scim]block must be set totrue - Not affected: Grafana OSS, Grafana Enterprise versions prior to 12.0.0 or after 12.2.1, and any deployment where SCIM provisioning is not enabled
Vendor Security History
Grafana Labs has previously fixed several privilege escalation and authentication bypass vulnerabilities in its products, including:
- CVE-2022-24812 (Privilege Escalation in API Keys)
- CVE-2022-36062 (Privilege Escalation in Folder Permissions)
- CVE-2022-35957 (Privilege Escalation in Auth Proxy)
- CVE-2022-31107 (Account Takeover in OAuth)
The company maintains a public security advisory database and typically releases patches within weeks of a vulnerability's discovery. Grafana Labs introduced SCIM provisioning as a public preview in April 2025, and the speed of that rollout may have contributed to this vulnerability.
