BIT-grafana-2026-92539: Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
Published Oct 29, 2026
·Updated
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
Affected Software
4 affected componentsFixes available
bitnami/grafana>=11.6.0<12.4.13
12.4.13
bitnami/grafana>=13.0.0<13.0.11
13.0.11
bitnami/grafana>=13.1.0<13.1.8
13.1.8
bitnami/grafana>=13.2.0<13.2.4
13.2.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/grafanato a version that resolves this vulnerability.Fixed in 12.4.13 - Upgrade
Upgrade
bitnami/grafanato a version that resolves this vulnerability.Fixed in 13.0.11 - Upgrade
Upgrade
bitnami/grafanato a version that resolves this vulnerability.Fixed in 13.1.8 - Upgrade
Upgrade
bitnami/grafanato a version that resolves this vulnerability.Fixed in 13.2.4
Event History
Oct 29, 2026
Advisory Published
via OSV·08:46 AM
Data Sourced
via OSV·08:46 AM
DescriptionSeverityAffected Software