[ CVE-2026-92539 · Published 20 Oct 2026 ]

Vulnerability in Grafana Enterprise

CVSS 6.7 EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

BSI CERT-Bund20 Oct 2026WID-SEC-2026-4070

Grafana: Vulnerability allows file manipulation Translated from German
CVE-2026-92539

[ References ]References

grafana.com/security/security-advisories/cve-2026-92539

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

Grafana: Vulnerability allows file manipulation Translated from German

[ References ]References