Attackers Escalate Privilege Through Critical Grafana Vulnerability

Grafana Labs has released critical security patches addressing a severe vulnerability in Grafana Enterprise that could allow attackers to escalate privileges and impersonate administrative users.

The vulnerability, tracked as CVE-2025-41115, affects Grafana Enterprise versions 12.0.0 through 12.2.1 and carries a maximum CVSS score of 10.0 (Critical).

Understanding the SCIM Provisioning Flaw

The vulnerability resides in Grafana’s SCIM (System for Cross-domain Identity Management) provisioning feature, introduced in April 2025 to streamline user and team management through automated lifecycle management.

However, a critical flaw in user identity handling allows a malicious or compromised SCIM client to provision users with numeric external identifiers that override internal user IDs, potentially granting unauthorized actors administrative access.

The issue only manifests when both the enableSCIM feature flag is set to true and the user_sync_enabled configuration option is enabled in the auth.scim block.

Organizations without this specific configuration remain unaffected by this vulnerability. Significantly, Grafana OSS users are not impacted by this security issue.

Grafana Labs has released patched versions across all affected branches: Grafana Enterprise 12.3.0 (latest), 12.2.1, 12.1.3, and 12.0.6.

The company coordinated with all cloud providers offering Grafana Cloud Pro, including Amazon Managed Grafana and Azure Managed Grafana, ensuring patches were applied before the public announcement.

Organizations running Grafana Enterprise should prioritize upgrading to patched versions immediately.

The vulnerability poses a significant risk to multi-tenant environments where user separation and privilege isolation are critical security controls.

Grafana’s security team discovered the vulnerability on November 4, 2025, during internal audits and initiated an immediate incident response.

The company verified that Grafana Cloud instances were not exploited and deployed an internal patch within hours.

The complete timeline demonstrates responsible disclosure practices, with the public announcement occurring on November 19, 2025, coinciding with the Grafana 12.3 release.

Attribute	Value
CVE ID	CVE-2025-41115
Vulnerability Type	Incorrect Privilege Assignment / User ID Override
Affected Product	Grafana Enterprise 12.0.0 – 12.2.1
CVSS Score	10.0 (Critical)
Attack Vector	Network (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Patched Versions	12.3.0, 12.2.1, 12.1.3, 12.0.6
Impact	Privilege escalation, admin impersonation, unauthorized data access
Prerequisites	SCIM provisioning and user_sync_enabled both configured

Organizations using SCIM provisioning should verify their configurations and deploy patches without delay to prevent potential privilege escalation attacks.

Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates

The post Attackers Escalate Privilege Through Critical Grafana Vulnerability appeared first on Cyber Security News.