Medium severity · published Oct 20, 2026
CVE-2026-92539
Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
6.7
CVSS
0.3%
EPSS
No
On KEV
Description
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Grafana · Grafana
11.6.0 through 12.3.11; 12.4.0 before 12.4.13; 13.0.0 before 13.0.11; 13.1.0 before 13.1.8; 13.2.0 before 13.2.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92539
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92539
grafana.com
https://grafana.com/security/security-advisories/cve-2026-92539
More from Grafana
7.5
CVE-2021-43798
Grafana path traversal
7.3
CVE-2021-39226
Snapshot authentication bypass in grafana
9.9
CVE-2025-11539
Arbitrary Code Execution in Grafana Image Renderer Plugin
9.8
CVE-2025-41115
Incorrect privilege assignment
9.8
CVE-2023-3128
Grafana is validating Azure AD accounts based on the email claim