What is GHSA-9vhw-jmv9-mgm3?

GHSA-9vhw-jmv9-mgm3 is a security advisory published by GitHub Security Advisories with Medium severity. A service account with user-management permissions in one organization can read, modify, disable...

Which CVE IDs does GHSA-9vhw-jmv9-mgm3 cover?

GHSA-9vhw-jmv9-mgm3 covers the following CVE IDs: CVE-2026-92539. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9vhw-jmv9-mgm3?

GHSA-9vhw-jmv9-mgm3 has a CVSS v3 base score of 6.7, published by GitHub Security Advisories.

GHSA-9vhw-jmv9-mgm3MediumCVSS 6.7

A service account with user-management permissions in one organization can read, modify, disable...

Vendor

GitHub Security Advisories

Published

October 20, 2026

Last Modified

October 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-92539 →

📋 Description

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-92539
https://grafana.com/security/security-advisories/cve-2026-92539
https://github.com/advisories/GHSA-9vhw-jmv9-mgm3