CVE-2026-92539
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
- CVSS 3.1
- 6.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H - EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-639, CWE-863, CWE-1220
- Published
- Modified
- Record from
- the NVD, synced