CVE-2026-92539
published 2026-10-20CVE-2026-92539: A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same…
PriorityP338medium6.7CVSS 3.1
AVNACLPRHUINSUCLIHAH
EPSS
0.34%
25.8th percentile
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | — | — |
| grafana | grafana_enterprise | 11.6.0 – 12.3.11 | — |
| grafana | grafana_enterprise | >= 12.4.0 < 12.4.13 | 12.4.13 |
| grafana | grafana_enterprise | >= 13.0.0 < 13.0.11 | 13.0.11 |
| grafana | grafana_enterprise | >= 13.1.0 < 13.1.8 | 13.1.8 |
| grafana | grafana_enterprise | >= 13.2.0 < 13.2.4 | 13.2.4 |
| multicluster-globalhub | multicluster-globalhub-grafana-rhel9 | — | — |
| rhacm2 | acm-grafana-rhel9 | — | — |
| rhceph | grafana-rhel10 | — | — |
| rhceph | grafana-rhel9 | — | — |
CVSS provenance
nvdv3.16.7MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
vendor_redhat6.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (ins
ghsa_unreviewed·2026-10-20
CVE-2026-92539 [MEDIUM] CWE-639 A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (ins
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
Red Hat
grafana: Grafana: Unauthorized cross-organization user management via the SCIM API
vendor_redhat·2026-10-20·CVSS 6.7
CVE-2026-92539 [MEDIUM] CWE-639 grafana: Grafana: Unauthorized cross-organization user management via the SCIM API
grafana: Grafana: Unauthorized cross-organization user management via the SCIM API
A flaw was found in Grafana. An authenticated service account with user-management permissions in one organization can access users in other organizations on the same instance due to missing access controls in the System for Cross-domain Identity Management (SCIM) API. This allows an authorized account to view, modify, disable, or delete users belonging to separate organizations, breaking tenant isolation.
Package: multicluster-globalhub/multicluster-globalhub-grafana-rhel9 (Multicluster Global Hub) - Fix deferred
Package: rhacm2/acm-grafana-rhel9 (Red Hat Advanced Cluster Management for Kubernetes 2) - Fix deferred
Package: rhceph/grafana-rhel9 (Red Hat Ceph Storage 7) - Fix deferred
Package: rhceph/gr
No detection rules found.
No public exploits indexed.
2026-10-20
Published