CVE-2025-41115: 
Grafana vulnerability analysis and mitigation

CVE-2025-41115 is a critical Incorrect Privilege Assignment vulnerability (CWE-266) in Grafana Enterprise's SCIM provisioning feature that allows a malicious or compromised SCIM client to provision a user with a numeric externalId, enabling override of internal user IDs and leading to user impersonation or privilege escalation. It affects Grafana Enterprise versions 12.0.0 through 12.2.1 (specifically < 12.0.7, < 12.1.4, and < 12.2.2) where SCIM provisioning is enabled. The vulnerability was published on November 21, 2025. The CVSS v3.1 base score is 10.0 (Critical) per the GitHub Advisory Database, reflecting a network-accessible, no-authentication-required attack with changed scope (GitHub Advisory, Grafana Advisory).

The root cause is improper validation of the externalId field during SCIM user provisioning (CWE-266: Incorrect Privilege Assignment). When a SCIM client provisions a new user with a numeric externalId value, Grafana's identity handling logic incorrectly maps that value to an internal user ID, allowing the attacker-controlled ID to collide with or override an existing user's internal identifier. Exploitation requires network access to the SCIM API endpoint and that both the enableSCIM feature flag and user_sync_enabled configuration option in the [auth.scim] block are set to true — conditions present in any organization using automated user lifecycle management via SCIM. Public proof-of-concept code is available on GitHub (GitHub Advisory, Grafana Advisory).

Successful exploitation allows an attacker to impersonate any Grafana user — including administrators — by overriding internal user IDs through a crafted SCIM provisioning request. This grants full confidentiality, integrity, and availability impact: an attacker can access sensitive dashboards and data sources, modify or delete configurations, and potentially pivot to connected data infrastructure. The changed scope in the CVSS vector indicates that the impact extends beyond the Grafana instance itself to any systems or data accessible through Grafana's integrations (GitHub Advisory, Grafana Advisory).

Multiple public proof-of-concept exploits are available on GitHub, including Blackash-CVE-2025-41115 and GrafanaSCIMalform, both added in early March 2026. The ShadowPad malware family has been reported to have weaponized this vulnerability (Feedly). The EPSS score is approximately 0.019–0.057%, reflecting relatively low automated exploitation probability at time of scoring, though active exploitation has been confirmed. The vulnerability is detectable by Qualys (IDs 5006301, 530675) and Nessus (ID 276746), and has been covered in CISA's weekly vulnerability bulletin (SB25-328). No CISA KEV catalog listing was identified in available data (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing Grafana Enterprise instances running versions 12.0.0–12.2.1 using Shodan, Censys, or similar tools. Confirm SCIM is enabled by probing the SCIM API endpoint (e.g., /apis/scim.grafana.app/v0alpha1/).
2. Obtain or compromise SCIM client credentials: SCIM provisioning typically requires an API token or service account. An attacker may obtain these through credential theft, phishing, or by compromising an identity provider (IdP) integration.
3. Identify target user ID: Enumerate existing Grafana users to determine the internal numeric ID of a high-privilege account (e.g., an admin). This may be possible via the Grafana API if any read access is available, or through trial-and-error.
4. Craft malicious SCIM provisioning request: Send a SCIM POST /Users request with a numeric externalId matching the target user's internal Grafana ID:

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "externalId": "1",
  "userName": "attacker@evil.com",
  "name": { "givenName": "Attacker", "familyName": "User" },
  "emails": [{ "value": "attacker@evil.com", "primary": true }]
}

5. Trigger identity override: Grafana's flawed identity handling maps the numeric externalId to the internal user ID, associating the attacker-controlled account with the target user's identity and privileges.
6. Authenticate as impersonated user: Log in with the newly provisioned attacker account to gain the privileges of the overridden user (e.g., Grafana admin), enabling full dashboard access, data source manipulation, and further lateral movement (GitHub Advisory, Grafana Advisory).

• Network: Unexpected SCIM API requests (POST /apis/scim.grafana.app/v0alpha1/Users) with numeric externalId values; SCIM provisioning traffic from unfamiliar or unauthorized IP addresses.
• Logs: Grafana audit logs showing new user creation via SCIM with numeric externalId fields; authentication events for newly provisioned accounts immediately followed by admin-level actions; mismatches between SCIM-provisioned user attributes and expected IdP-sourced data.
• Application Behavior: Unexpected privilege escalation for recently created or modified user accounts; admin actions performed by accounts not recognized in the identity provider; duplicate or conflicting user records in Grafana's user database.
• File System / Configuration: Unauthorized changes to Grafana dashboards, data sources, or alert configurations shortly after anomalous SCIM provisioning events (GitHub Advisory, Grafana Advisory).

Grafana has released patched versions: 12.0.7, 12.1.4, and 12.2.2 (and 12.3.0+). Organizations should upgrade to one of these versions immediately. If immediate patching is not possible, disable SCIM provisioning by setting the enableSCIM feature flag to false or setting user_sync_enabled = false in the [auth.scim] configuration block. Additionally, ensure that SCIM clients are trusted, properly authenticated, and that SCIM API access is restricted to known, authorized IP ranges (GitHub Advisory, Grafana Advisory).

Grafana published a dedicated security advisory and blog post describing the vulnerability as critical severity, urging immediate patching (Grafana Advisory). BleepingComputer covered the issue under the headline "Grafana warns of max-severity admin spoofing vulnerability," and The Hacker News reported on the CVSS 10.0 score and impersonation risk (BleepingComputer, The Hacker News). Government cybersecurity agencies including Canada's CCCS (AV25-778), Singapore's CSA (AL-2025-109), and Belgium's CCB issued advisories. The vulnerability trended on Reddit's r/CVEWatch and r/SecOpsDaily, and security researchers on Mastodon and Bluesky highlighted the maximum severity score and admin impersonation risk.