Read the docs
TI-2025-27465 Aliases CVE-2025-41115GHSA-w62r-7c53-fmc5

Incorrect privilege assignment in Grafana Enterprise

Priority HIGH 66CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-266.

Summary

SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation. This vulnerability applies only if all of the following conditions are met: - `enableSCIM` feature flag set to true - `user_sync_enabled` config option in the `[auth.scim]` block set to true

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.17498 97th percentileScored 2026-11-07
Fix Fixed Grafana Enterprise (Grafana): 12.2.1github.com/grafana/grafana (Go): 12.0.7, 12.1.4, 12.2.2 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GrafanaGrafana Enterprise12.0.0 to before 12.2.112.2.1Patch availableCNA
—github.com/grafana/grafana (Go)12.0.0 to before 12.0.712.0.7Patch availableGHSA-w62r-7c53-fmc5
—github.com/grafana/grafana (Go)12.1.0 to before 12.1.412.1.4Patch availableGHSA-w62r-7c53-fmc5
—github.com/grafana/grafana (Go)12.2.0 to before 12.2.212.2.2Patch availableGHSA-w62r-7c53-fmc5
—github.com/grafana/grafana (Go)1.9.2-0.20250310110405-e6fdb746f235 to before 1.9.2-0.20251106142618-ca5d898120151.9.2-0.20251106142618-ca5d89812015Patch availableGHSA-w62r-7c53-fmc5
  • Grafana Enterprise VendorGrafana Affected 12.0.0 to before 12.2.1 Fixed in 12.2.1 Patch available CNA
  • github.com/grafana/grafana (Go) Vendor— Affected 12.0.0 to before 12.0.7 Fixed in 12.0.7 Patch available GHSA-w62r-7c53-fmc5
  • github.com/grafana/grafana (Go) Vendor— Affected 12.1.0 to before 12.1.4 Fixed in 12.1.4 Patch available GHSA-w62r-7c53-fmc5
  • github.com/grafana/grafana (Go) Vendor— Affected 12.2.0 to before 12.2.2 Fixed in 12.2.2 Patch available GHSA-w62r-7c53-fmc5
  • github.com/grafana/grafana (Go) Vendor— Affected 1.9.2-0.20250310110405-e6fdb746f235 to before 1.9.2-0.20251106142618-ca5d89812015 Fixed in 1.9.2-0.20251106142618-ca5d89812015 Patch available GHSA-w62r-7c53-fmc5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*12.0.0 to before 12.2.1VulnerableGrafana
  • cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:* Versions 12.0.0 to before 12.2.1 Vulnerable ·Grafana

Remediation

  • Fix · CNA Grafana Enterprise (Grafana) Fixed in 12.2.1
  • Fix · GHSA-w62r-7c53-fmc5 github.com/grafana/grafana (Go) Fixed in 12.0.7 Advisory →
  • Fix · GHSA-w62r-7c53-fmc5 github.com/grafana/grafana (Go) Fixed in 12.1.4 Advisory →
  • Fix · GHSA-w62r-7c53-fmc5 github.com/grafana/grafana (Go) Fixed in 12.2.2 Advisory →
  • Fix · GHSA-w62r-7c53-fmc5 github.com/grafana/grafana (Go) Fixed in 1.9.2-0.20251106142618-ca5d89812015 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

Not affected: 5 products
  • Multicluster Global Hub
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-41115
  2. 2026-10-03 Alias added: GHSA-w62r-7c53-fmc5

References

Advisory 3

Other 7

  • TI-2021-16611 Snapshot authentication bypass in grafana KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19604 Grafana path traversal KEVCVSS 3.1HIGH 7.5
  • TI-2024-08600 Grafana SQL Expressions allow for remote code execution CVSS 4.0CRITICAL 9.4
  • TI-2023-02931 Authentication bypass by spoofing in Grafana CVSS 3.1CRITICAL 9.8
  • TI-2020-10491 The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control… CVSS 3.1HIGH 8.2
  • TI-2025-03662 Open redirect in Grafana CVSS 3.1HIGH 7.6
See all 103 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences