CVE-2026-92539

MediumCVSS 6.7

Published: 20/10/2026(UTC)Updated: 20/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Summary

A service account with user-management permissions in one organization can read, modify, disable, or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.

Risk Assessment

An attacker with permissions in one organization can affect user accounts in other organizations, breaching integrity and confidentiality. This may lead to unauthorized access or account lockout.

Recommendation

Upgrade Grafana Enterprise to a version containing the fix. Until then, restrict service account permissions for user management and monitor SCIM API activity.

Other vulnerabilities in Grafana Enterprise

CVE-2026-12704Medium
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.

Original NVD description (English source)

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS