{"id":"CVE-2026-92539","kind":"vulnerability","aliases":["CVE-2026-92539"],"related":[],"title":"Grafana: service account reads and changes users in other organizations","description":"A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.","summary":"A Grafana service account with user-management rights in one organization can read, modify, disable or delete users in other organizations on the same instance through the SCIM API. An attacker gets cross-tenant control over user accounts, but only on Grafana Enterprise with SCIM enabled.","severity":"medium","cvss":6.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise","grafana","runtime","scim","self-hosted"],"not_affected_if":["open-source-grafana","scim-disabled","single-organization"],"how_to_check":"- Confirm the edition and SCIM setting in the Grafana server configuration (`[auth.scim]` section enabled to true) and check whether the instance is Grafana Enterprise\n- List service accounts with user-management permissions across organizations and review which ones are needed","fix":null,"status":"open","published_at":"2026-10-20T17:17:43+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T03:46:45+00:00","updated_at":"2026-10-25T03:46:45+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:46:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Grafana: service account reads and changes users in other organizations","impact":"medium","summary":"A Grafana service account with user-management rights in one organization can read, modify, disable or delete users in other organizations on the same instance through the SCIM API. An attacker gets cross-tenant control over user accounts, but only on Grafana Enterprise with SCIM enabled.","category":"runtime","nicknames":[],"who_cares":["grafana","self-hosted","scim","enterprise"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker alters or deletes users in other organizations","analyst_note":"Find the fixed Grafana versions and the advisory at the NVD link or Grafana security advisories; the sources given do not name affected or patched versions.","how_to_check":"- Confirm the edition and SCIM setting in the Grafana server configuration (`[auth.scim]` section enabled to true) and check whether the instance is Grafana Enterprise\n- List service accounts with user-management permissions across organizations and review which ones are needed","needs_analyst":true,"not_affected_if":["open-source-grafana","scim-disabled","single-organization"],"who_is_affected":"Only Grafana Enterprise instances with SCIM enabled are affected. Instances that run open-source Grafana or leave SCIM off are not exposed. Teams running several organizations on one instance face the cross-tenant risk most.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000594,"input_tokens":3292,"output_tokens":530,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-92539':13A,16A 'account':3A,27B,63B,74C 'affect':115C 'api':53B,102C 'attack':55B 'belong':90C 'chang':6A 'control':60B 'cross':58B 'cross-ten':57B 'cve':11A,14A 'delet':41B,88C 'direct':104C 'disabl':39B,86C 'enabl':71B,113C 'enterpris':17B,68B,109C 'get':56B 'grafana':1A,18B,25B,67B,97C,108C 'host':23B 'insecur':103C 'instanc':49B,98C,110C 'manag':31B,78C 'modifi':38B,85C 'object':105C 'one':34B,81C 'organ':10A,35B,45B,82C,93C 'permiss':79C 'read':4A,37B,84C 'refer':106C 'right':32B 'runtim':19B 'scim':20B,52B,70B,101C,112C 'self':22B 'self-host':21B 'servic':2A,26B,73C 'tenant':59B 'user':7A,30B,42B,62B,77C,89C 'user-manag':29B,76C","nicknames":[],"mitigations":[],"who_affected":"Only Grafana Enterprise instances with SCIM enabled are affected. Instances that run open-source Grafana or leave SCIM off are not exposed. Teams running several organizations on one instance face the cross-tenant risk most.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T17:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92539","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92539","severity":null,"published_at":"2026-10-20T17:17:43+00:00","modified_at":"2026-10-20T20:06:37+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}