Description
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
Published: 2026-10-20
Score: 6.7 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
Title Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
Weaknesses CWE-1220
CWE-639
CWE-863
References
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GRAFANA

Published:

Updated: 2026-10-20T18:08:00.621Z

Reserved: 2026-09-16T12:55:31.889Z

Link: CVE-2026-92539

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T17:17:43.333

Modified: 2026-10-20T17:17:43.333

Link: CVE-2026-92539

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-1220

    Insufficient Granularity of Access Control

  • CWE-639

    Authorization Bypass Through User-Controlled Key

  • CWE-863

    Incorrect Authorization