CVE-2026-92539: Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
Published Oct 20, 2026
·Updated
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
Affected Software
1 affected component
Grafana Grafana Enterprise
Event History
Oct 20, 2026
CVE Published
via MITRE·04:55 PM
Data Sourced
via MITRE·04:55 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Only Grafana Enterprise instances with SCIM enabled are affected. The issue applies when multiple organizations share the same Grafana instance.
2
What access does an attacker need?
An attacker needs a service account that has user-management permissions in one organization. No user interaction is required.
3
What could an attacker do across organizations?
Using the SCIM API, the service account can read, modify, disable, or delete users belonging to other organizations on the same instance.