CVE-2026-92539
Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
- Record
CVE-2026-92539- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-639, CWE-863, CWE-1220
- Updated
- 2026-11-02
EUVDEUVD-2026-105187
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
- Record
EUVD-2026-105187- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9vhw-jmv9-mgm3
A service account with user-management permissions in one organization can read, modify, disable...
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
- Record
GHSA-9vhw-jmv9-mgm3- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-639
- Updated
- 2026-11-02
NVD
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
- Record
CVE-2026-92539- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-639, CWE-863, CWE-1220
- Updated
- 2026-11-02
OSVBIT-grafana-2026-92539 No score
Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
- Record
BIT-grafana-2026-92539- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
grafanaBitnami |
11.6.0 up to 12.4.13, 13.0.0 up to 13.0.11, 13.1.0 up to 13.1.8, 13.2.0 up to 13.2.4 | 12.4.1313.0.1113.1.813.2.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-92539 is a medium vulnerability (CVSS 6.7) in Grafana Enterprise, published October 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in grafana 12.4.13.