User Identity Handling Vulnerability in Grafana Enterprise and Cloud

CVE-2025-41115

What is CVE-2025-41115?

CVE-2025-41115 is a security vulnerability discovered in Grafana Enterprise and Grafana Cloud, focusing specifically on user identity management. Grafana, a widely used open-source analytics and monitoring platform, introduced SCIM (System for Cross-domain Identity Management) provisioning to enhance user and team management via automated user lifecycle processes. This vulnerability arises in Grafana versions 12.x when SCIM provisioning is enabled and configured. It allows a malicious actor or compromised SCIM client to provision a user with a numeric external ID that can potentially override existing internal user IDs. As a result, this could facilitate user impersonation or privilege escalation, creating significant risks for any organization relying on Grafana for monitoring and analytics.

The vulnerability is particularly concerning as it triggers under specific configurations, specifically when both the enableSCIM feature flag and the user_sync_enabled config option are set to true. If exploited, an attacker can manipulate user identities, undermining trust and security protocols within the organization.

Potential impact of CVE-2025-41115

1. User Impersonation: The vulnerability enables unauthorized users to take on the identity of legitimate users, potentially leading to unauthorized access to sensitive data and critical operations within Grafana.

2. Privilege Escalation: By overriding internal user IDs, an attacker may escalate their privileges within the system, allowing them to perform actions that should be restricted, which can compromise data integrity and confidentiality.

3. Automated Exploitation Risks: If a compromised SCIM client is exploited, organizations could face widespread identity manipulation across their user base, creating extensive vulnerabilities not only within Grafana but potentially also affecting integrated systems and applications that rely on user authentication processes.

News Articles

BleepingComputer

CVE-2025-41115

Grafana warns of max severity admin spoofing vulnerability

Grafana Labs is warning of a maximum severity vulnerability (CVE-2025-41115) in its Enterprise product that can be exploited to treat new users as administrators or for privilege escalation.

13 hours ago

References