Grafana SCIM Provisioning User Identity Vulnerability Allowing Impersonation and Privilege Escalation

A vulnerability has been identified in Grafana versions 12.x with SCIM provisioning enabled. This issue allows a malicious or compromised SCIM client to provision a user with a numeric external ID, potentially overriding internal user IDs. Such an override could lead to impersonation or privilege escalation. The vulnerability arises from improper handling of user identities and is only applicable when the 'enableSCIM' feature flag is active and 'user_sync_enabled' is set to true in the SCIM authentication block.

Impact

Exploitation of this vulnerability could result in unauthorized user impersonation or privilege escalation within Grafana.