{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92539", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-09-16T12:55:31.889Z", "datePublished": "2026-10-20T16:55:17.875Z", "dateUpdated": "2026-10-20T18:08:00.621Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "11.6.0", "versionType": "semver"}, {"lessThan": "12.4.13", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.11", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.8", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.4", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "datePublic": "2026-10-13T10:21:52.000Z", "descriptions": [{"lang": "en", "value": "A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected."}], "metrics": [{"cvssV3_1": {"baseScore": 6.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "CWE-639", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "description": "CWE-863", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1220", "description": "CWE-1220", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-10-20T16:55:17.875Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-92539"}], "source": {"discovery": "EXTERNAL_REPORT"}, "title": "Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-92539", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-20T17:22:31.577037Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T18:08:00.621Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-92539", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-20T17:22:31.577037Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T18:07:38.961Z"}}], "cna": {"title": "Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise", "source": {"discovery": "EXTERNAL_REPORT"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H"}}], "affected": [{"vendor": "Grafana", "product": "Grafana Enterprise", "versions": [{"status": "affected", "version": "11.6.0", "versionType": "semver", "lessThanOrEqual": "12.3.11"}, {"status": "affected", "version": "12.4.0", "lessThan": "12.4.13", "versionType": "semver"}, {"status": "affected", "version": "13.0.0", "lessThan": "13.0.11", "versionType": "semver"}, {"status": "affected", "version": "13.1.0", "lessThan": "13.1.8", "versionType": "semver"}, {"status": "affected", "version": "13.2.0", "lessThan": "13.2.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-10-13T10:21:52.000Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-92539", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1220", "description": "CWE-1220"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-10-20T16:55:17.875Z"}}}, "cveMetadata": {"cveId": "CVE-2026-92539", "state": "PUBLISHED", "dateUpdated": "2026-10-20T18:08:00.621Z", "dateReserved": "2026-09-16T12:55:31.889Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-10-20T16:55:17.875Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "11.6.0", "versionType": "semver"}, {"lessThan": "12.4.13", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.11", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.8", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.4", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected."}], "id": "CVE-2026-92539", "lastModified": "2026-10-20T19:19:23.963", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.5, "source": "security@grafana.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92539", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-20T17:22:31.577037Z", "version": "2.0.3"}}]}, "published": "2026-10-20T17:17:43.333", "references": [{"source": "security@grafana.com", "url": "https://grafana.com/security/security-advisories/cve-2026-92539"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-863"}, {"lang": "en", "value": "CWE-1220"}], "source": "security@grafana.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.6.0,12.3.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.4.0,12.4.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.0.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.1.0,13.1.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.2.0,13.2.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Grafana Enterprise", "source": "cna", "vendor": "Grafana"}, "product": "grafana_enterprise", "vendor": "grafana"}], "created": "2026-10-20T18:45:13.945580+00:00", "updated": "2026-10-20T19:00:14.936276+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana_enterprise"]}