ID:12182 - Exploit for Incorrect privilege assignment in Grafana Enterprise - CVE-2025-41115

Link to public exploit:

Vulnerability description

The vulnerability allows a remote user to escalate privileges within the application.

The vulnerability exists due to an error in identity handling. A malicious or compromised SCIM client can provision a user with a numeric externalId, which allows to override internal user IDs and lead to impersonation or privilege escalation.

Successful exploitation of the vulnerability requires that the enableSCIM feature flag set to true and the "user_sync_enabled" config option in the [auth.scim] block set to "true".

Remediation