Medium severity6.7NVD Advisory· Published Oct 20, 2026· Updated Oct 20, 2026

CVE-2026-92539

Description

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.

Affected products

Grafana/Grafana Enterprisellm-fuzzy

Patches

Vulnerability mechanics

References

grafana.com/security/security-advisories/cve-2026-92539nvd

News mentions

No linked articles in our index yet.

cvss	0.436
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000