SCIM provisioning was introduced in Grafana Enterprise to automate user lifecycle, but a flaw in user identity handling allows a compromised or malicious SCIM client to provision a user with a numeric externalId. This numeric identifier can override Grafana's internal user IDs, enabling the attacker to impersonate an existing user or elevate privileges. The weakness falls under CWE-266, Privilege‑separation out of bounds, and results in a high‑severity security impact.

Grafana Enterprise versions 12.x with the SCIM feature enabled are affected. Enabling the "enableSCIM" feature flag and setting "user_sync_enabled" to true in the [auth.scim] block must be present for the vulnerability to be exploitable. The issue is specific to Grafana’s SCIM implementation and does not impact other Grafana components outside of the 12.x series when SCIM is inactive.

The CVSS score of 10 highlights the maximum severity, yet the EPSS score of less than 1% reflects a low likelihood of exploitation in the wild at present. The vulnerability is not currently listed in CISA’s KEV catalog. Exploitation would require a malicious or compromised SCIM client with appropriate permissions, making the attack vector internal to the SCIM integration. Even with a low probability, the potential for user impersonation or privileged access makes this a critical risk for organizations relying on SCIM provisioning.