Insecure Direct Object Reference in Grafana Enterprise Impacting User Management
CVE-2026-92539

6.7MEDIUM

Key Information:

Vendor

Grafana
Status
Grafana Enterprise
Vendor
CVE Published:
20 October 2026

What is CVE-2026-92539?

A vulnerability allows unauthorized service accounts with user-management permissions in one Grafana organization to interact with user accounts belonging to other organizations within the same instance. This can lead to excessive privileges being granted through the SCIM API, enabling a malicious user to read, modify, disable, or delete user accounts across organizations. Affected users should ensure that SCIM is carefully managed and that access is restricted appropriately to mitigate the risks associated with this vulnerability.

Affected Version(s)

Grafana Enterprise 11.6.0 <= 12.3.11

Grafana Enterprise 12.4.0 < 12.4.13

Grafana Enterprise 13.0.0 < 13.0.11

References

https://grafana.com/security/security-advisories/cve-2026...
vendor-advisory

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.