CVE-2025-41115 affects Grafana Enterprise 12.0.0 with SCIM provisioning enabled (enableSCIM=true and user_sync_enabled=true). The vulnerability arises from improper handling of user identity during SCIM provisioning, allowing a malicious SCIM client to assign a numeric externalId that can override internal user IDs. This can result in impersonation or privilege escalation within the Grafana environment. The vulnerability is rated critical with a CVSS 3.1 score of 10.0, reflecting high impact on confidentiality, integrity, and availability. No exploits are currently known in the wild. The vulnerability was reserved in April 2025 and published in November 2025.

Successful exploitation allows an attacker controlling or compromising a SCIM client to override internal user IDs by provisioning users with numeric externalIds. This can lead to impersonation of other users or escalation of privileges within Grafana Enterprise, potentially compromising the confidentiality, integrity, and availability of the system. The vulnerability requires specific configuration settings to be enabled, limiting exposure to environments using SCIM provisioning with user synchronization enabled.

No official patch or fix is currently provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider disabling SCIM provisioning by setting the enableSCIM feature flag to false or disabling user synchronization (user_sync_enabled=false) in the [auth.scim] configuration block if feasible. Monitor vendor communications for updates and apply patches promptly once released.