Auth Proxy in Grafana creates a cache key by concatenating the user name and forwarded identity attributes without any separator, which allows distinct identities to share one key. An attacker who can control the forwarded attributes can craft them to match the key of a higher‑privileged user while that user’s cache entry is still valid. When the collision occurs the attacker is authenticated as the other user, potentially gaining Administrator privileges and compromising confidentiality, integrity, and availability of the Grafana instance.

The flaw impacts self‑managed installations of Grafana Enterprise and Grafana OSS that use Auth Proxy authentication with identity caching enabled where the sync_ttl value is greater than zero. Any instance operating under those conditions is susceptible, regardless of version, as no specific version information is provided in the advisory.

The CVSS score of 7.1 signals high severity, and the vulnerability is not listed in CISA KEV. EPSS data is not available, but the exploitation path requires only an authenticated session capable of manipulating forwarded identity attributes. An attacker can trigger a cache collision by sending a request that sets suitable attributes; if the collision succeeds the cache entry is used to authenticate the attacker as the higher‑privileged user without further credential checks. Given the low barrier for exploitation once authenticated, the risk to affected environments is high.