Description
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.
In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation.
This vulnerability applies only if all of the following conditions are met:
- `enableSCIM` feature flag set to true
- `user_sync_enabled` config option in the `[auth.scim]` block set to true
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana Enterprise | 12.0.0 – < 12.2.1 | 12.2.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | govulncheck-vulndb | 0.0.20251209T172047-150000.1.127.1 | SUSE-SU-2025:4395-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20251209T172047-150000.1.127.1 | SUSE-SU-2025:4395-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
I3r1h0n/GrafanaSCIMalform ★ 1 · Dec 3, 2025
Exploit and test stand for CVE-2025-41115
-
rockmelodies/Blackash-CVE-2025-41115 ★ 0 · Nov 24, 2025
CVE-2025-41115
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/grafana/grafana | >= 12.0.0, < 12.0.7 | 12.0.7 | GHSA-w62r-7c53-fmc5 |
| Go | github.com/grafana/grafana | >= 12.1.0, < 12.1.4 | 12.1.4 | GHSA-w62r-7c53-fmc5 |
| Go | github.com/grafana/grafana | >= 12.2.0, < 12.2.2 | 12.2.2 | GHSA-w62r-7c53-fmc5 |
| Go | github.com/grafana/grafana | >= 1.9.2-0.20250310110405-e6fdb746f235, < 1.9.2-0.20251106142618-ca5d89812015 | 1.9.2-0.20251106142618-ca5d89812015 | GHSA-w62r-7c53-fmc5 |
| Go | github.com/grafana/grafana | >= 1.9.2-0.20250310110405-e6fdb746f235 | — | GO-2025-4153 |
Advisories 4
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- VDE-2026-049 Balluff GmbH: Multiple Vulnerabilities Affecting BNI EGW-720-007-K095 and BAV MA-NC-00025-01 CERT@VDE · Jun 30, 2026
- SUSE-SU-2025:4395-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-2641 Grafana Enterprise: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Nov 23, 2025
References
- https://grafana.com/security/security-advisories/cve-2025-41115 vendor-advisory