CVE-2026-92539
CVE-2026-92539 · Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
CVSS 6.7 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: applications
Affected products and versions
grafana
- Versions
- ≥ 11.6.0, ≤ 12.3.11: Affected (semver)
- ≥ 12.4.0, < 12.4.13: Affected (semver)
- ≥ 13.0.0, < 13.0.11: Affected (semver)
- ≥ 13.1.0, < 13.1.8: Affected (semver)
- ≥ 13.2.0, < 13.2.4: Affected (semver)
Update to 12.4.13; Update to 13.0.11; Update to 13.1.8; Update to 13.2.4