CVE-2026-92539: CWE-639 in Grafana Grafana Enterprise

This vulnerability (CVE-2026-92539) in Grafana Enterprise involves an insecure direct object reference flaw in the SCIM API. A service account with user-management permissions scoped to one organization can read, modify, disable, or delete users belonging to other organizations on the same Grafana instance. The issue affects only instances with SCIM enabled. The affected versions include >=11.6.0 <=12.3.11, >=12.4.0 <12.4.13, >=13.0.0 <13.0.11, >=13.1.0 <13.1.8, and >=13.2.0 <13.2.4. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity and availability impacts.

An attacker with a service account having user-management permissions in one organization can improperly access and manipulate user accounts in other organizations on the same Grafana Enterprise instance. This can lead to unauthorized reading, modification, disabling, or deletion of users across organizational boundaries, potentially disrupting service availability and compromising user integrity.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, organizations should consider restricting SCIM API access and carefully auditing service account permissions to limit cross-organization user management capabilities.