CVE-2025-41115: Grafana Enterprise SCIM numeric externalId lets a user impersonate admins

Critical 9.8 EPSS 17.5%

Grafana Enterprise 12.x maps a SCIM user's externalId directly to the internal user.uid, so a malicious or compromised SCIM client can provision a user with a numeric externalId (for example "1") that is treated as an existing internal account such as the Admin. This allows impersonation or privilege escalation. Only instances with the enableSCIM feature flag on and user_sync_enabled = true in [auth.scim] are affected; Grafana OSS is not. Grafana rates it CVSS 10.0 and found no exploitation in Grafana Cloud.

• CVE-2025-41115CVE identifier
• 9.8CVSS 3.1 base score (critical)
• 17.5%EPSS: chance of exploitation in the next 30 days (higher than 97% of CVEs)
• 2025-11-21published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• Grafana Enterprise 12.0.0 to 12.2.1 (with SCIM provisioning enabled and user sync on)

Fixed in:

• Grafana Enterprise 12.3.0
• Grafana Enterprise 12.2.1+security-01
• Grafana Enterprise 12.1.3+security-01
• Grafana Enterprise 12.0.6+security-01

Am I affected?

grafana-server -v || grafana server -v
grep -n -A5 '^\[auth.scim\]' /etc/grafana/grafana.ini
grep -n 'enableSCIM' /etc/grafana/grafana.ini

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

# Grafana APT repository (apt.grafana.com)
sudo apt-get update
sudo apt-get install --only-upgrade grafana-enterprise
sudo systemctl restart grafana-server

sudo apt-get update
sudo apt-get install --only-upgrade grafana-enterprise
sudo systemctl restart grafana-server

# Grafana RPM repository (rpm.grafana.com)
sudo dnf upgrade grafana-enterprise
sudo systemctl restart grafana-server

docker pull grafana/grafana-enterprise:12.3.0
# or stay on your minor: grafana/grafana-enterprise:12.2.1-security-01, 12.1.3-security-01, 12.0.6-security-01
# then recreate the container (docker compose up -d) with the new tag

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

If you cannot patch yet

• Until you can upgrade, disable SCIM user sync: set user_sync_enabled = false in the [auth.scim] block (or turn off the enableSCIM feature flag) and restart Grafana; the flaw only applies when both are enabled.

Sources

• Grafana security advisory CVE-2025-41115
• Grafana blog: critical severity security fix for CVE-2025-41115
• Install Grafana on Debian or Ubuntu
• Install Grafana on RHEL or Fedora
• https://grafana.com/security/security-advisories/cve-2025-41115
• CVE-2025-41115 on CVE.org
• CVE-2025-41115 on NVD

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.