CVE-2026-92539: Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/grafanato a version that resolves this vulnerability.Fixed in 12.4.13 - Upgrade
Upgrade
bitnami/grafanato a version that resolves this vulnerability.Fixed in 13.0.11 - Upgrade
Upgrade
bitnami/grafanato a version that resolves this vulnerability.Fixed in 13.1.8 - Upgrade
Upgrade
bitnami/grafanato a version that resolves this vulnerability.Fixed in 13.2.4
Event History
Frequently Asked Questions
Which deployments are affected?
Only Grafana Enterprise instances with SCIM enabled are affected. The issue applies when multiple organizations share the same Grafana instance.
What access does an attacker need?
An attacker needs a service account that has user-management permissions in one organization. No user interaction is required.
What could an attacker do across organizations?
Using the SCIM API, the service account can read, modify, disable, or delete users belonging to other organizations on the same instance.