{"id":8347,"date":"2025-11-28T14:30:28","date_gmt":"2025-11-28T18:30:28","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=8347"},"modified":"2025-11-28T13:35:21","modified_gmt":"2025-11-28T17:35:21","slug":"grafana-responds-to-severe-scim-flaw-after-security-teams-flag-account-risks","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/grafana-responds-to-severe-scim-flaw-after-security-teams-flag-account-risks\/","title":{"rendered":"Grafana responds to severe SCIM flaw after security teams flag account risks"},"content":{"rendered":"<p data-start=\"633\" data-end=\"1114\"><a href=\"https:\/\/grafana.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Grafana<\/a> has acted quickly after security teams uncovered a major flaw in its Enterprise platform. The issue, now tracked as CVE 2025 41115, allowed certain SCIM provisioning requests to collide with existing user records. Because of that, an attacker could slip into an account that did not belong to them, and in rare situations, the access might reach an administrative level. The finding alarmed several enterprise customers who rely on Grafana for daily operational visibility.<\/p>\n<p data-start=\"1116\" data-end=\"1578\">The problem became apparent when engineers noticed how the platform handled numeric externalId values during automated provisioning. If a compromised client submitted a simple number, the system mapped it to an internal user record. It sounds like a small technical detail, yet it carried serious consequences for environments where SCIM and user sync were both active. Once the team confirmed the behavior, they began preparing fixes for all supported branches.<\/p>\n<p data-start=\"1580\" data-end=\"1959\">Customers now have <a href=\"https:\/\/grafana.com\/blog\/2025\/11\/19\/grafana-enterprise-security-update-critical-severity-security-fix-for-cve-2025-41115\/?camp=blog&amp;mdm=social&amp;src=tw\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">patches available<\/a> in versions 12.0.6, 12.1.3, 12.2.1 and the recently released 12.3.0. <a href=\"https:\/\/grafana.com\/products\/cloud\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Grafana\u2019s cloud service received<\/a> corrections before the public announcement, and the company coordinated with major managed providers so they could validate their environments.<\/p>\n<p data-start=\"1961\" data-end=\"2415\">Because many hosting companies treat Grafana as a core part of their monitoring stack, the discovery carried extra weight. A breach in a monitoring tool does not simply expose charts. It can distort data that teams use to make decisions, hide warning signs during an outage, or reveal customer usage details. As a result, some hosting providers reviewed their access models to confirm that no unexpected user accounts appeared during the affected period.<\/p>\n<p data-start=\"2417\" data-end=\"2839\">The incident offers a reminder that monitoring platforms require the same update discipline as production systems. Although these tools often run quietly in the background, they connect to sensitive data and internal operations.<\/p>\n<p data-start=\"2417\" data-end=\"2839\">When a small identity feature misbehaves, it can create gaps that attackers might try to exploit. Regular updates and periodic reviews continue to be the clearest way to avoid those situations.<\/p>\n<p data-start=\"2841\" data-end=\"3058\">Grafana has urged all Enterprise users who rely on SCIM to update as soon as possible. The company says it will continue to audit its provisioning workflows so it can minimize the risk of similar issues in the future.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Grafana has acted quickly after security teams uncovered a major flaw in its Enterprise platform. The issue, now tracked as CVE 2025 41115, allowed certain SCIM provisioning requests to collide with existing user records. Because of that, an attacker could slip into an account that did not belong to them, and in rare situations, the [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[80,5085,5084,14,5086],"class_list":["post-8347","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-cybersecurity","tag-enterprise-security","tag-grafana","tag-hosting","tag-scim-vulnerability"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Grafana responds to severe SCIM flaw after security teams flag account risks - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/grafana-responds-to-severe-scim-flaw-after-security-teams-flag-account-risks\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Grafana responds to severe SCIM flaw after security teams flag account risks - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"Grafana has acted quickly after security teams uncovered a major flaw in its Enterprise platform. The issue, now tracked as CVE 2025 41115, allowed certain SCIM provisioning requests to collide with existing user records. Because of that, an attacker could slip into an account that did not belong to them, and in rare situations, the [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/grafana-responds-to-severe-scim-flaw-after-security-teams-flag-account-risks\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2025-11-28T18:30:28+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-11-28T17:35:21+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/grafana-responds-to-severe-scim-flaw-after-security-teams-flag-account-risks\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/grafana-responds-to-severe-scim-flaw-after-security-teams-flag-account-risks\/\",\"name\":\"Grafana responds to severe SCIM flaw after security teams flag account risks - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2025-11-28T18:30:28+00:00\",\"dateModified\":\"2025-11-28T17:35:21+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/grafana-responds-to-severe-scim-flaw-after-security-teams-flag-account-risks\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/grafana-responds-to-severe-scim-flaw-after-security-teams-flag-account-risks\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/grafana-responds-to-severe-scim-flaw-after-security-teams-flag-account-risks\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Grafana responds to severe SCIM flaw after security teams flag account risks\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Grafana responds to severe SCIM flaw after security teams flag account risks - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/grafana-responds-to-severe-scim-flaw-after-security-teams-flag-account-risks\/","og_locale":"en_US","og_type":"article","og_title":"Grafana responds to severe SCIM flaw after security teams flag account risks - Web Hosting News","og_description":"Grafana has acted quickly after security teams uncovered a major flaw in its Enterprise platform. The issue, now tracked as CVE 2025 41115, allowed certain SCIM provisioning requests to collide with existing user records. Because of that, an attacker could slip into an account that did not belong to them, and in rare situations, the [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/grafana-responds-to-severe-scim-flaw-after-security-teams-flag-account-risks\/","og_site_name":"Web Hosting News","article_published_time":"2025-11-28T18:30:28+00:00","article_modified_time":"2025-11-28T17:35:21+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/grafana-responds-to-severe-scim-flaw-after-security-teams-flag-account-risks\/","url":"https:\/\/hostingdiscussion.com\/news\/grafana-responds-to-severe-scim-flaw-after-security-teams-flag-account-risks\/","name":"Grafana responds to severe SCIM flaw after security teams flag account risks - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2025-11-28T18:30:28+00:00","dateModified":"2025-11-28T17:35:21+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/grafana-responds-to-severe-scim-flaw-after-security-teams-flag-account-risks\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/grafana-responds-to-severe-scim-flaw-after-security-teams-flag-account-risks\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/grafana-responds-to-severe-scim-flaw-after-security-teams-flag-account-risks\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"Grafana responds to severe SCIM flaw after security teams flag account risks"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":169,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/8347","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=8347"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/8347\/revisions"}],"predecessor-version":[{"id":8348,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/8347\/revisions\/8348"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=8347"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=8347"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=8347"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}