The vulnerability arises because Grafana's Auth Proxy implementation builds an identity cache key by concatenating the authenticated username with forwarded identity attributes without any delimiter. When separate users can supply identical attribute sets that match another user's key, a cache collision occurs and the second user’s cached session is reused. An attacker who can control the forwarded attributes can therefore forge a cache entry that maps to a higher‑privileged account, such as an Administrator, thereby bypassing authentication and gaining full control over the instance. This is an authentication bypass with potential privilege escalation, meeting the criteria for CWE‑1023, CWE‑290, CWE‑639, and CWE‑863.

The flaw affects all self‑managed installations of Grafana Enterprise and Grafana OSS that enable Auth Proxy authentication with identity caching enabled (sync_ttl greater than zero). Because no version restrictions are specified, any Grafana release meeting those conditions can be compromised. This includes both cloud‑self‑hosted and on‑premises deployments that rely on the Auth Proxy feature.

The CVSS score of 7.1 indicates high severity, and the EPSS score of 0.00345 (0.345%) shows a very low exploitation probability but not negligible. The vulnerability is not currently listed in CISA’s KEV catalog, so there is no evidence of active exploitation yet. Attackers must first obtain an authenticated session that can supply forwarded identity attributes; once such a session exists, they can send a crafted request that triggers the cache collision and authenticates them as the target user without further credential checks. Because the attack requires only user‑controlled attributes and an active session, the risk to affected environments remains high once suitable credentials are available.