CVE-2026-92539: 
Grafana vulnerability analysis and mitigation

CVE-2026-92539 is an insecure direct object reference (IDOR) vulnerability in Grafana Enterprise's SCIM API that allows a service account with user-management permissions in one organization to read, modify, disable, or delete users belonging to other organizations on the same Grafana instance. Only Grafana Enterprise instances with SCIM enabled are affected; Grafana OSS and Grafana Cloud are not impacted. Affected versions span Grafana Enterprise 11.6.0 through 12.3.11, 12.4.0 through 12.4.12, 13.0.0 through 13.0.10, 13.1.0 through 13.1.7, and 13.2.0 through 13.2.3. The vulnerability was published on October 20, 2026, with a CVSS v3.1 base score of 6.7 (Medium/High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an authorization bypass through user-controlled keys (CWE-639), compounded by incorrect authorization (CWE-863) and insufficient granularity of access control (CWE-1220). The SCIM API fails to enforce organization-level isolation when resolving user object references, allowing a service account authenticated to Organization A to supply user identifiers belonging to Organization B and successfully perform read, modify, disable, or delete operations on those users. Exploitation requires the attacker to already possess a service account with user-management permissions within at least one organization on the target Grafana Enterprise instance, and SCIM must be enabled. No public proof-of-concept code has been identified (GitHub Advisory, Red Hat Bugzilla).

A successful exploit allows a privileged service account in one organization to cross organizational boundaries and enumerate, alter, disable, or permanently delete user accounts in any other organization hosted on the same Grafana Enterprise instance. This poses a significant risk in multi-tenant deployments where multiple organizations share a single Grafana instance, as it can lead to unauthorized data exposure (low confidentiality impact), unauthorized modification of user attributes or roles (high integrity impact), and denial of service through mass account disablement or deletion (high availability impact). Lateral movement within the Grafana instance across organizational boundaries is the primary concern (GitHub Advisory).

There is no evidence of active in-the-wild exploitation, and no public proof-of-concept exploit has been published as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable (per NVD SSVC assessment) and requires high privileges — specifically, a valid service account with user-management permissions within at least one organization on the target instance (GitHub Advisory).

1. Reconnaissance: Identify a Grafana Enterprise instance with SCIM enabled. This may be discoverable via HTTP response headers, Grafana's API endpoints, or organizational documentation.
2. Obtain service account credentials: Acquire or compromise a service account that has user-management permissions within any organization on the target Grafana instance (e.g., through credential theft, phishing, or insider access).
3. Enumerate users across organizations: Use the SCIM API (e.g., GET /api/scim/v2/Users) with the compromised service account token, supplying user IDs or filters that reference users in other organizations. The API fails to restrict results to the authenticated account's own organization.
4. Perform cross-organization actions: Issue SCIM API requests (PATCH, PUT, or DELETE on /api/scim/v2/Users/{userId}) targeting user objects from other organizations to modify attributes, disable accounts, or delete users entirely.
5. Achieve objective: Depending on attacker goals — exfiltrate user metadata, disrupt access for users in other organizations, or escalate privileges by modifying user roles across organizational boundaries (GitHub Advisory).

• Network: Unusual SCIM API requests (e.g., GET /api/scim/v2/Users, PATCH /api/scim/v2/Users/{id}, DELETE /api/scim/v2/Users/{id}) originating from a service account associated with one organization but referencing user IDs belonging to other organizations.
• Logs: Grafana audit logs showing a single service account performing user read/modify/delete operations across multiple organizations; unexpected PATCH or DELETE SCIM API calls outside of normal provisioning windows.
• Logs: Authentication logs showing a service account token being used to access SCIM endpoints at unusual times or from unexpected IP addresses.
• Application Behavior: Unexpected user account disablement or deletion events in organizations that did not initiate the change; user attribute modifications (e.g., email, role) not correlated with legitimate IdP provisioning activity.

Grafana has released patched versions: 12.4.13, 13.0.11, 13.1.8, and 13.2.4. Organizations running versions 11.6.0 through 12.3.11 (for which no direct patch path exists in the standard release) should contact Grafana support for guidance. As immediate workarounds: disable SCIM if it is not actively required, and restrict service account permissions to the minimum necessary scope within their specific organization. Upgrading to a patched release is the recommended long-term remediation (GitHub Advisory, Red Hat Bugzilla).