[GHSA-w62r-7c53-fmc5] Grafana Incorrect Privilege Assignment vulnerability

[cdupuis]

Updates

• Affected products

Comments
Each release of Grafana 12.x made on 19th of November has the CVE fix incorporated. The current ranges mark every version of Grafana < 12.3 as vulnerable to this 10.0 CVE. That's simply not correct. Thank you.

[Copilot]

Pull request overview

This PR corrects the affected version ranges for Grafana security advisory CVE-2025-41115 (GHSA-w62r-7c53-fmc5), which addresses an Incorrect Privilege Assignment vulnerability in Grafana's SCIM provisioning feature. The original advisory incorrectly marked all Grafana versions < 12.3.0 as vulnerable, when in fact the vulnerability was fixed in specific patch releases for each minor version series (12.0.7, 12.1.4, and 12.2.2), all released on November 19, 2025.

• Split a single broad version range into three precise version ranges corresponding to the 12.0.x, 12.1.x, and 12.2.x release series
• Updated the modified timestamp to reflect the correction
• Aligned the advisory with the actual fix versions released by Grafana

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[advisory-database]

Hi @cdupuis! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!