GRAFANA PATCHES CVSS 10.0 SCIM FLAW ENABLING IMPERSONATION AND PRIVILEGE ESCALATION

Summary from the TLDR InfoSec newsletter

A critical vulnerability in Grafana's SCIM user management feature (CVE-2025-41115) allowed attackers to impersonate users or escalate privileges if certain settings were enabled. Only Grafana Enterprise versions 12.0.0 to 12.2.1 with SCIM activated were affected. The flaw, found internally, was quickly patched. Users are strongly urged to update to the latest secure release to prevent exploitation.