External risk intelligence

Grafana SCIM Identity Handling Vulnerability Allows User Impersonation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-41115

The vulnerability affects the SCIM provisioning feature in Grafana. While SCIM is an identity management protocol often used in enterprise environments, it typically operates between trusted identity providers and the service provider. Exposure is limited to deployments where SCIM is explicitly enabled and configured, and public internet reachability is not a default requirement for this specific management function.

Privilege Escalation

Grafana

12.0.0 to before 12.2.1

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This issue impacts Grafana Enterprise and Cloud users with a specific configuration enabling SCIM provisioning. If exploited, it could allow unauthorized users to impersonate others or escalate their privileges within Grafana, potentially affecting access to sensitive data. The primary concern is confirming if this specific configuration is in use.

User impersonation or privilege escalation possible.
Affects automated user management if SCIM is enabled.
Confirm if SCIM provisioning is configured.

Attack Path

How an attacker could exploit the issue

An attacker could leverage a compromised or malicious SCIM client to provision users with an external ID that matches an internal user ID. This would allow them to impersonate existing users and potentially gain elevated privileges within Grafana.

SCIM provisioning must be enabled.
A SCIM client can assign a numeric external ID.
User impersonation or privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

When Grafana's SCIM provisioning is enabled and configured, a compromised SCIM client could provision a user with a numeric `externalId`. This could allow an attacker to impersonate internal users or escalate privileges by overriding internal user IDs. This vulnerability specifically affects Grafana Enterprise and Grafana Cloud versions where the `enableSCIM` feature flag is true and `user_sync_enabled` is set to true in the `[auth.scim]` configuration block.

User accounts and internal IDs at risk.
Compromised SCIM client could override IDs.
Potential user impersonation and privilege escalation.

Operational Fix

Recommended remediation, mitigation, and detection steps

In real-world deployments, Grafana Enterprise and Grafana Cloud application owners or platform teams are likely responsible for managing SCIM provisioning. The first practical step is to identify all instances of Grafana where SCIM provisioning is enabled and configured, confirm their exposure, and then coordinate with the accountable owner to plan remediation based on the business criticality.

Application or platform owners should own.
Verify SCIM provisioning configuration first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Grafana and how does it use SCIM?

Grafana is a platform used for visualizing and monitoring data. SCIM, or System for Cross-domain Identity Management, is an automation feature in Grafana Enterprise and Cloud that streamlines how organizations manage user lifecycles, such as adding or syncing team members from an identity provider.

What does CWE-266 mean for CVE-2025-41115?

CWE-266 identifies an Incorrect Privilege Assignment weakness. In this CVE, it means the software fails to properly restrict how identity data is processed. Consequently, a malicious SCIM client can supply a specifically formatted ID that tricks the system into misidentifying a new user as an existing, high-privileged one.

How does the SCIM trigger path work?

This vulnerability is only triggered if a SCIM client provides a numeric external ID that overlaps with an existing internal Grafana user ID. It does not occur if SCIM is disabled, or if the required feature flags, such as 'enableSCIM' and 'user_sync_enabled', are set to false.

Is my Grafana instance at risk according to Halo Surface Signal?

Halo Surface Signal notes that this risk is limited to specific deployments where SCIM is active. While SCIM is common in enterprise environments, it is not always exposed to the public internet, and the vulnerability only applies if you have explicitly turned on and configured the SCIM provisioning feature.

What should I do first to manage this risk?

Begin by auditing your Grafana configuration files to determine if 'enableSCIM' and 'user_sync_enabled' are both set to true. If they are, document these instances and coordinate with your platform team to review the security of your connected SCIM clients while planning your update path.

References

grafana.com/security/security-advisories/cve-2025-41115

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.