---
id: "CVE-2026-92539"
kind: "vulnerability"
aliases: ["CVE-2026-92539"]
title: "Grafana: service account reads and changes users in other organizations"
severity: "medium"
cvss: 6.7
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["enterprise", "grafana", "runtime", "scim", "self-hosted"]
not_affected_if: ["open-source-grafana", "scim-disabled", "single-organization"]
published_at: "2026-10-20T17:17:43+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T03:46:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92539", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# Grafana: service account reads and changes users in other organizations

A Grafana service account with user-management rights in one organization can read, modify, disable or delete users in other organizations on the same instance through the SCIM API. An attacker gets cross-tenant control over user accounts, but only on Grafana Enterprise with SCIM enabled.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the edition and SCIM setting in the Grafana server configuration (`[auth.scim]` section enabled to true) and check whether the instance is Grafana Enterprise
- List service accounts with user-management permissions across organizations and review which ones are needed

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92539

## From the sources

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_