A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on…
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Grafana Labs
- Product
- Grafana / Loki / Tempo / Mimir
- CVSS
- 6.7
- Exposure class
- Network management
Why it ranks 8 (Routine)
- CVSS 6.7 medium
- Product class: network management
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-92539 on this site · NVD · CVE.org · Vulnpedia