Critical Vulnerability Alert: User Impersonation Risk in Grafana SCIM Provisioning (CVE-2025-41115)

Overview

A critical security vulnerability, identified as CVE-2025-41115, has been discovered in Grafana Enterprise and Grafana Cloud related to SCIM (System for Cross-domain Identity Management) provisioning. This vulnerability, introduced in April to streamline user and team management through automated user lifecycle management, could allow a malicious or compromised SCIM client to provision a user with a specific numeric externalId. This can then lead to internal user ID override, ultimately resulting in user impersonation and privilege escalation.

Technical Details

The vulnerability resides in how Grafana versions 12.x handle user identities when SCIM provisioning is enabled and configured. Specifically, if a SCIM client (potentially malicious) provides a numeric value for a user’s externalId attribute during provisioning, it can overwrite the internal user ID within Grafana. This allows an attacker to assume the identity and privileges of an existing user.

Important Conditions: This vulnerability is only exploitable if all of the following conditions are met:

• The enableSCIM feature flag is set to true.
• The user_sync_enabled configuration option within the [auth.scim] block is set to true.

If both conditions are met, a crafted SCIM request could potentially exploit the described vulnerability.

CVSS Analysis

• CVE ID: CVE-2025-41115
• Severity: CRITICAL
• CVSS Score: 10.0

Possible Impact

The exploitation of CVE-2025-41115 can have severe consequences:

• User Impersonation: An attacker can gain unauthorized access to Grafana by impersonating legitimate users.
• Privilege Escalation: The attacker can escalate their privileges to those of the impersonated user, potentially gaining administrative access.
• Data Breach: With elevated privileges, an attacker can access sensitive data stored within Grafana.
• System Compromise: Depending on the attacker’s level of access, they could potentially compromise the entire Grafana system.

Mitigation and Patch Steps

To mitigate the risk of CVE-2025-41115, immediately take the following steps:

1. Upgrade Grafana: Upgrade to a patched version of Grafana (later than 12.x) where this vulnerability is addressed. Consult the Grafana release notes for specific versions containing the fix.
2. Disable SCIM Provisioning (If Possible): If SCIM provisioning is not essential, consider disabling it by setting the enableSCIM feature flag to false and/or setting the `user_sync_enabled` to `false` in your Grafana configuration.
3. Review SCIM Client Security: If you are using SCIM provisioning, ensure that the SCIM client is secure and not compromised. Verify its configuration and access controls.
4. Monitor Logs: Monitor Grafana logs for suspicious activity related to SCIM provisioning, such as unusual user creation or modification events.

References

• Grafana Security Advisory: CVE-2025-41115