GHSA-w62r-7c53-fmc5 BIT-grafana-2025-41115 CVE-2025-41115 GO-2025-4153

Grafana Incorrect Privilege Assignment vulnerability

Critical Go

Severity: 10.0 / 10; Critical · CVSS 3.1
Exploit chance (EPSS): 17.50%; Chance of exploitation in the next 30 days. Higher than 97.14% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-266 Incorrect Privilege Assignment
Fix: 12.0.7; Upgrade github.com/grafana/grafana to this version or later

Description

SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.

In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation.

This vulnerability applies only if all of the following conditions are met:

enableSCIM feature flag set to true
user_sync_enabled config option in the [auth.scim] block set to true

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/grafana/grafana	`>= 12.0.0, < 12.0.7`	`12.0.7`
github.com/grafana/grafana	`>= 12.1.0, < 12.1.4`	`12.1.4`
github.com/grafana/grafana	`>= 12.2.0, < 12.2.2`	`12.2.2`
github.com/grafana/grafana	`>= 1.9.2-0.20250310110405-e6fdb746f235, < 1.9.2-0.20251106142618-ca5d89812015`	`1.9.2-0.20251106142618-ca5d89812015`
github.com/grafana/grafana	`>= 1.9.2-0.20250310110405-e6fdb746f235`	No fix yet

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/grafana/grafana Go → `12.0.7`

go

go get github.com/grafana/grafana@v12.0.7 && go mod tidy

Severity breakdown

CVSS 3.1 10.0

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-266: Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

How to prevent it

Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design, Operation: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

References

Advisories

Packages

github.com/grafana/grafana

Timeline

Nov 21, 2025 Published
Oct 18, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-8pjx-jj86-j47p Grafana path traversal	High Known exploited	Also affects github.com/grafana/grafana
CVE-2021-39226 Authentication bypass for viewing and deletions of snapshots	High Known exploited	Also affects github.com/grafana/grafana
GHSA-3w66-95m3-8jxg Grafana: Pre-authentication denial of service in the public dashboard query handler	High	Also affects github.com/grafana/grafana
GHSA-9g84-39mm-q4p3 Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug	Medium	Also affects github.com/grafana/grafana
GHSA-f74p-cwhp-x2wx Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.	High	Also affects github.com/grafana/grafana
GHSA-9493-h4f5-633x Grafana: Path traversal in the Tempo and Loki data source plugins	Medium	Also affects github.com/grafana/grafana
GHSA-wfhv-mj62-f5xh Grafana: Users can generate Service Account tokens after permissions removal	High	Also affects github.com/grafana/grafana
GHSA-gxcp-jjxh-rwp4 Grafana: SQL Expressions Read File From Disk	Medium	Also affects github.com/grafana/grafana

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor