Grafana Enterprise CVE-2025-41115

Exploitation requires ALL of: (1) Grafana Enterprise or Grafana Cloud on a 12.x version; (2) the enableSCIM feature flag set to true; (3) user_sync_enabled set to true in the [auth.scim] configuration block; and (4) attacker control of a malicious or compromised SCIM provisioning client capable of creating/updating users. The specific technique is provisioning a user whose externalId is numeric, which overrides an internal user ID. Limiting factors that reduce real-world exposure: SCIM provisioning is a non-default, opt-in feature (only introduced April 2025), it is Enterprise/Cloud-only (not open-source Grafana), and the attacker must already possess SCIM client access/credentials - contradicting the input vector's PR:N and making this unexploitable against default or SCIM-disabled deployments.

The input CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N) rates this 9.8 Critical, implying network-reachable, unauthenticated, low-complexity exploitation with full C:H/I:H/A:H impact. However, these signals conflict sharply with the description and must be reconciled before prioritization. The description states exploitation requires 'a malicious or compromised SCIM client' - i.e., an actor who already controls a credentialed provisioning integration - which contradicts PR:N; the real-world privilege prerequisite is closer to PR:H/PR:L. Furthermore, the flaw is gated behind two non-default configuration conditions (enableSCIM feature flag true AND user_sync_enabled true in [auth.scim]) and applies only to Grafana Enterprise/Cloud 12.x, so default deployments are NOT affected. The remaining signals point to low near-term urgency: EPSS is 0.04% (13th percentile), this is NOT listed in CISA KEV, and no public POC was provided - status is 'no public exploit identified at time of analysis.' Net assessment: a genuinely high-impact privilege-escalation/impersonation bug (CWE-266) for the specific subset of orgs running Grafana Enterprise 12.x with SCIM provisioning enabled, but the headline 9.8 overstates real-world risk because exploitation presupposes a compromised/malicious SCIM client and a non-default configuration. Patch promptly if SCIM is in use; otherwise low practical exposure. VERIFY the PR:N claim with the vendor advisory, as CVSS attack-vector and the description's access assumptions disagree.

In a Grafana Enterprise 12.x instance with SCIM user synchronization enabled, an attacker who controls or has compromised the configured SCIM provisioning client submits a provisioning request for a user carrying a crafted numeric externalId. Because identity handling trusts that value, the numeric externalId collides with and overrides an existing internal user ID, letting the attacker impersonate that user or escalate to higher privileges. No public exploit code was provided, and exploitation depends on already holding SCIM client access plus the non-default SCIM configuration.