CVE-2026-92539
Last modified
CVE-2026-92539 is a medium-severity vulnerability rated 6.7/10 on the CVSS scale. A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected..
Description
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana Enterprise | >= 11.6.0, <= 12.3.11; >= 12.4.0, < 12.4.13; >= 13.0.0, < 13.0.11; >= 13.1.0, < 13.1.8; >= 13.2.0, < 13.2.4 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-92539?
How severe is CVE-2026-92539?
How do I fix CVE-2026-92539?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92531Operating system command injection vulnerability in the SVN …7.5
- CVE-2026-92532Unrestricted file upload vulnerability in the BugTracker.NET…7.5
- CVE-2026-92533Path traversal vulnerability in the BugTracker.NET file down…7.1
- CVE-2026-92536The Paid Membership Plugin, Ecommerce, User Registration For…8.8
- CVE-2026-92537The Newsletter – Send awesome emails from WordPress plugin f…5.3
- CVE-2026-92538The LearnPress – WordPress LMS Plugin for Create and Sell On…6.1
- CVE-2026-9254An unauthenticated OS command injection vulnerability exists…8.7
- CVE-2026-92540The Import and export users and customers WordPress plugin b…7.2
- CVE-2026-92541The Import and export users and customers WordPress plugin b…7.2
- CVE-2026-92542The firewall rules which mark VXLAN datagrams for encryption…6.9
- CVE-2026-92543Docker Engine classifies a registry hostname as insecure usi…7.6
- CVE-2026-92546Authentication bypass by spoofing vulnerability in Keepnet L…7.5
Are you affected by CVE-2026-92539?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST