What is CVE-2026-92539?

CVE-2026-92539 is a security advisory published by Grafana Labs Security. Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise

Why does CVE-2026-92539 have no CVE ID yet?

Grafana Labs Security published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by CVE-2026-92539?

CVE-2026-92539 affects 2 products, including: Grafana Enterprise; Grafana.

CVE-2026-92539Disclosed before NVD

Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise

Vendor

Grafana Labs Security

Published

October 13, 2026

Last Modified

—

📋 Description

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.

🎯 Affected products2

Grafana Enterprise
Grafana

🔗 References (1)

advisoryhttps://grafana.com/security/security-advisories/cve-2026-92539/