A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 20 Oct 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected. | |
| Title | Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise | |
| Weaknesses | CWE-1220 CWE-639 CWE-863 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GRAFANA
Published:
Updated: 2026-10-20T18:08:00.621Z
Reserved: 2026-09-16T12:55:31.889Z
Link: CVE-2026-92539
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-20T17:17:43.333
Modified: 2026-10-20T17:17:43.333
Link: CVE-2026-92539
Redhat
No data.
OpenCVE Enrichment
No data.