CVE-2025-41115

The SCIM provisioning feature, introduced for automatic user lifecycle management, improperly handles the value of the externalId field. A malicious or compromised SCIM client can provide a numeric externalId value when creating or updating a user. Such a value may be treated by Grafana as an internal user ID, making it possible to overwrite existing account identifiers. As a result, an attacker can gain access to another user's account or escalate their own privileges to a higher level.

An attacker can perform privilege escalation and obtain the privileges of any user in the system, including administrators, or impersonate an existing account. In an extreme scenario, complete takeover of the Grafana instance is possible with access to sensitive data, dashboards, and configuration.

Apply patches available from the vendor according to the references (https://grafana.com/security/security-advisories/CVE-2025-41115). Until the update is applied, it is recommended to disable SCIM provisioning by setting `enableSCIM` to `false` or `user_sync_enabled` to `false` in the `[auth.scim]` configuration if this functionality is not essential.

Grafana Enterprise and Grafana Cloud version 12.x, only when both conditions are simultaneously met: feature flag `enableSCIM` set to `true` and the `user_sync_enabled` option in the `[auth.scim]` section set to `true`.