Live › vulnerability › CVE-2026-92539
Go to dashboardA Grafana service account with user-management rights in one organization can read, modify, disable or delete users in other organizations on the same instance through the SCIM API. An attacker gets cross-tenant control over user accounts, but only on Grafana Enterprise with SCIM enabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only Grafana Enterprise instances with SCIM enabled are affected. Instances that run open-source Grafana or leave SCIM off are not exposed. Teams running several organizations on one instance face the cross-tenant risk most.
No product ranges from the sources yet.
[auth.scim] section enabled to true) and check whether the instance is Grafana EnterpriseUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-92539")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.