CVE-2026-92539

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92539", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-09-16T12:55:31.889Z", "datePublished": "2026-10-20T16:55:17.875Z", "dateUpdated": "2026-10-20T18:08:00.621Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "11.6.0", "versionType": "semver"}, {"lessThan": "12.4.13", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.11", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.8", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.4", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "datePublic": "2026-10-13T10:21:52.000Z", "descriptions": [{"lang": "en", "value": "A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected."}], "metrics": [{"cvssV3_1": {"baseScore": 6.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "CWE-639", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "description": "CWE-863", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1220", "description": "CWE-1220", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-10-20T16:55:17.875Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-92539"}], "source": {"discovery": "EXTERNAL_REPORT"}, "title": "Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-92539", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-20T17:22:31.577037Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T18:08:00.621Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-92539", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-20T17:22:31.577037Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T18:07:38.961Z"}}], "cna": {"title": "Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise", "source": {"discovery": "EXTERNAL_REPORT"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H"}}], "affected": [{"vendor": "Grafana", "product": "Grafana Enterprise", "versions": [{"status": "affected", "version": "11.6.0", "versionType": "semver", "lessThanOrEqual": "12.3.11"}, {"status": "affected", "version": "12.4.0", "lessThan": "12.4.13", "versionType": "semver"}, {"status": "affected", "version": "13.0.0", "lessThan": "13.0.11", "versionType": "semver"}, {"status": "affected", "version": "13.1.0", "lessThan": "13.1.8", "versionType": "semver"}, {"status": "affected", "version": "13.2.0", "lessThan": "13.2.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-10-13T10:21:52.000Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-92539", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1220", "description": "CWE-1220"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-10-20T16:55:17.875Z"}}}, "cveMetadata": {"cveId": "CVE-2026-92539", "state": "PUBLISHED", "dateUpdated": "2026-10-20T18:08:00.621Z", "dateReserved": "2026-09-16T12:55:31.889Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-10-20T16:55:17.875Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "11.6.0", "versionType": "semver"}, {"lessThan": "12.4.13", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.11", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.8", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.4", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected."}], "id": "CVE-2026-92539", "lastModified": "2026-10-20T20:06:37.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.5, "source": "security@grafana.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92539", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-20T17:22:31.577037Z", "version": "2.0.3"}}]}, "published": "2026-10-20T17:17:43.333", "references": [{"source": "security@grafana.com", "url": "https://grafana.com/security/security-advisories/cve-2026-92539"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-863"}, {"lang": "en", "value": "CWE-1220"}], "source": "security@grafana.com", "type": "Secondary"}]}

{"bugzilla": {"description": "grafana: Grafana: Unauthorized cross-organization user management via the SCIM API", "id": "2556381", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556381"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "status": "draft"}, "cwe": "CWE-639", "details": ["A flaw was found in Grafana. An authenticated service account with user-management permissions in one organization can access users in other organizations on the same instance due to missing access controls in the System for Cross-domain Identity Management (SCIM) API. This allows an authorized account to view, modify, disable, or delete users belonging to separate organizations, breaking tenant isolation."], "name": "CVE-2026-92539", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Fix deferred", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Out of support scope", "package_name": "rhceph/grafana-rhel10", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-20T16:55:17Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-92539\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92539\nhttps://grafana.com/security/security-advisories/cve-2026-92539"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.6.0,12.3.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.4.0,12.4.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.0.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.1.0,13.1.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.2.0,13.2.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Grafana Enterprise", "source": "cna", "vendor": "Grafana"}, "product": "grafana_enterprise", "vendor": "grafana"}], "created": "2026-10-20T18:45:13.945580+00:00", "updated": "2026-10-20T19:00:14.936276+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana_enterprise"]}