CVE-2025-41115 is a critical flaw (CVSS 10.0) in Grafana 12.x when SCIM provisioning is enabled. A malicious or compromised SCIM client could create a user that overrides internal user IDs, leading to impersonation or privilege escalation. Fixed in 12.0.6, 12.1.3, 12.2.1 and 12.3.0.
What's affected
Grafana Labs published the advisory on 19 November 2025 for Grafana Enterprise. It affects Grafana 12.x, and the fixed versions are 12.0.6, 12.1.3, 12.2.1 and 12.3.0 or later.
The advisory says the bug applies only when two conditions are both true. First, the enableSCIM feature flag is set to true. Second, the user_sync_enabled option in the auth.scim block of the configuration is set to true. If either one is off, this flaw does not apply to your instance.
SCIM provisioning was added to Grafana Enterprise and Grafana Cloud earlier in 2025 to automate user and team lifecycle management. Grafana Cloud is mentioned in the description of the feature, so check the advisory for the status of hosted stacks.
How to check if you're exposed
First, find your version. In the Grafana UI, the version shows in the help menu. From the server, the health endpoint also reports it, so adjust the host and port to your setup.
curl -s http://localhost:3000/api/health
In a container, run the same request from inside it, or read the image tag. Anything in the 12.x line below the fixed versions for its branch is in range.
Next, check the two settings. Look in your grafana.ini or environment variables for enableSCIM under the feature toggles section, and for user_sync_enabled under the auth.scim section. If you manage Grafana through Helm or other configuration management, grep that source as well, since the running file may be generated.
If both are true, treat the instance as exposed until it is upgraded, and review which SCIM clients hold credentials to it.
What to do now
- Upgrade to 12.0.6, 12.1.3, 12.2.1 or 12.3.0, whichever matches your branch.
- If you cannot upgrade right away, turn off user_sync_enabled or the enableSCIM flag, and note what that does to your user provisioning.
- Review the identity provider side. List which systems hold SCIM tokens for Grafana, rotate those tokens, and remove any you do not recognize.
- Audit users created through SCIM since the feature was enabled, looking for odd numeric external IDs or unexpected admin rights.
- Re-read the Grafana advisory for updated guidance on Grafana Cloud.
Why it matters
The advisory classifies the issue as CWE-266, incorrect privilege assignment. Grafana identifies each user internally with an ID. When a SCIM client supplies an external ID that is a number, that value can collide with an internal user ID and overwrite it. The result is that one account can end up acting as another, including a more privileged one.
The score is 10.0 because the vector is network reachable, needs no privileges and changes scope. In practice the attack needs a malicious or compromised SCIM client, which narrows the real world risk to organizations that use the feature. This CVE is not on the CISA Known Exploited Vulnerabilities list.
The takeaway is to treat provisioning credentials as high value secrets. A SCIM token can create accounts, and accounts are privileges.
Try it yourself
Not every critical CVE affects you, and this one depends on two settings. This demo shows how to check whether a flaw is exploitable in your environment.
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I do not use SCIM?
No. Grafana says the flaw applies only when enableSCIM is true and user_sync_enabled is true in the auth.scim block.
Which versions contain the fix?
Grafana lists 12.0.6, 12.1.3, 12.2.1 and 12.3.0 or later as the fixed versions.
Sources
Last reviewed: 18 October 2026.
