CVE-2026-92539— Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
Quick assessment
Affected
Grafana Grafana Enterprise
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在同一个 Grafana 实例中，拥有用户管理权限的服务账户，可以通过 SCIM API（存在不安全的直接对象引用漏洞）读取、修改、禁用或删除属于其他组织的用户。此漏洞仅影响启用了 SCIM 功能的 Grafana Enterprise 实例。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92539
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
Source: CVE Program / CVE List V5
Vulnerability Description
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Grafana | Grafana Enterprise | 11.6.0 ~ 12.3.11 | - |
|
II. Public POCs for CVE-2026-92539
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92539
请登录查看更多情报信息。
Other References for CVE-2026-92539 (1)
-
https://grafana.com/security/security-advisories/cve-2026-92539 vendor-advisory
IV. Related Vulnerabilities
Same product: Grafana Enterprise
-
CVE-2026-9703
Viewer role can create, modify and delete Loki alerting rule -
CVE-2026-93294
Azure Monitor data source resource proxy allows calls to arb -
CVE-2026-33374
Unbounded memory allocation in the Prometheus rule conversio -
CVE-2026-15577
Git Sync connection configuration can be modified with read- -
CVE-2026-13719
Alert rules in restricted folders disclosed via the alert ru
Same vendor: Grafana
-
CVE-2026-9703
Viewer role can create, modify and delete Loki alerting rule -
CVE-2026-33374
Unbounded memory allocation in the Prometheus rule conversio -
CVE-2026-95502
Git Sync memory exhaustion via a malicious Git server -
CVE-2026-15577
Git Sync connection configuration can be modified with read- -
CVE-2026-93294
Azure Monitor data source resource proxy allows calls to arb
Same weakness: CWE-639
-
CVE-2026-111767
MCP TypeScript SDK: Experimental tasks were not tied to the -
CVE-2026-113643
EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get a -
CVE-2026-112861
WordPress Participants Database plugin <= 2.7.8.5 - Insecure -
CVE-2026-113665
ApostropheCMS: Missing Authorization on Notification PATCH/D -
CVE-2026-113655
ApostropheCMS: Same-parent page reorder in @apostrophecms/pa
V. Comments for CVE-2026-92539
No comments yet