A vulnerability in Grafana Enterprise's SCIM API allows a service account with user-management permissions in one organization to read, modify, disable, or delete users in other organizations on the same instance. This affects only Grafana Enterprise instances with SCIM enabled. The issue is due to insecure direct object reference. Fixed versions are available.