MEDIUM 6.7 NVD

CVE-2026-92539

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Gr

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.

References

https://grafana.com/security/security-advisories/cve-2026-92539

Published: 2026-10-20 · Source: NVD · Feed updated: 2026-10-20

This medium severity vulnerability with a CVSS score of 6.7 was published on 2026-10-20 via NVD.

vulnfeed aggregates 18176 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.