BIT-grafana-2025-41115

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2025-41115.json

JSON Data

https://api.test.osv.dev/v1/vulns/BIT-grafana-2025-41115

Aliases

Published

2025-11-25T17:58:55.355Z

Modified

2025-11-25T18:42:29.241323Z

Summary

Incorrect privilege assignment

Details

SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.

In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation.

This vulnerability applies only if all of the following conditions are met: - enableSCIM feature flag set to true - user_sync_enabled config option in the [auth.scim] block set to true

Database specific

{
    "cpes": [
        "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:go:*:*"
    ],
    "severity": "Critical"
}

References

Affected packages

Bitnami / grafana

Package

Name: grafana
Purl: pkg:bitnami/grafana

Severity

10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

12.0.0

Fixed

12.2.1