A flaw was found in Grafana. In Grafana where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId.

Because Grafana maps the SCIM externalId directly to the internal user.uid, numeric values (e.g. "1") may be interpreted as internal numeric user IDs. In specific cases this could allow the newly provisioned user to be treated as an existing internal account, such as the built-in Admin, leading to potential impersonation or privilege escalation.

This issue affects only deployments with SCIM enabled and configured.