Grafana Enterprise SCIM IDOR crossorg user edits
CVE-2026-92539 Published on October 20, 2026
Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
Weakness Types
What is an Insecure Direct Object Reference / IDOR Vulnerability?
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVE-2026-92539 has been classified to as an Insecure Direct Object Reference / IDOR vulnerability or weakness.
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-92539 has been classified to as an AuthZ vulnerability or weakness.
Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
Products Associated with CVE-2026-92539
Want to know whenever a new CVE is published for Grafana Labs Grafana? stack.watch will email you.
Affected Versions
Grafana Enterprise:- Version 11.6.0, <= 12.3.11 is affected.
- Version 12.4.0 and below 12.4.13 is affected.
- Version 13.0.0 and below 13.0.11 is affected.
- Version 13.1.0 and below 13.1.8 is affected.
- Version 13.2.0 and below 13.2.4 is affected.