All vulnerabilities
CVE-2026-92539

Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise

Grafana Grafana EnterpriseApplications & CMS
Open in ThreatlineRecord JSON
CVSS
6.7Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 25% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in12.4.13Also 13.0.11, 13.1.8 and 1 moreCVE List
Published20 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.

Text from CVE List

Affected versions 5

  • Grafana Enterpriseaffected: 11.6.0 through 12.3.11CVE List
  • Grafana Enterpriseaffected: 12.4.0 before 12.4.13CVE List
  • Grafana Enterpriseaffected: 13.0.0 before 13.0.11CVE List
  • Grafana Enterpriseaffected: 13.1.0 before 13.1.8CVE List
  • Grafana Enterpriseaffected: 13.2.0 before 13.2.4CVE List

References 1