The vulnerability is an insecure direct object reference in Grafana Enterprise’s SCIM API that allows a service account with user‑management rights in one organization to read, modify, disable or delete users in other organizations on the same Grafana instance. This flaw represents a form of cross‑organization privilege escalation that can impact user accounts, confidentiality, integrity, and availability across multiple organizational boundaries.

Only Grafana Enterprise installations with SCIM enabled are affected. No specific version numbers are supplied in the advisory, but the fix applies to all pre‑patch deployments of Grafana Enterprise that have SCIM activated.

The CVSS score of 6.7 indicates a moderate severity vulnerability. No EPSS score is available and the issue is not listed in CISA KEV, so there is currently no reported exploitation probability. The attack requires a valid service‑account credential with user‑management permissions, and exploitation proceeds by issuing SCIM API calls that bypass organization scoping checks, allowing an attacker to tamper with user objects in other organizations.