Medium
6.7
A service account with user-management permissions in one organization can read, modify, disable...
CVE-2026-92539
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana Enterprise |
11.6.0 – 12.3.11 ≥ 12.4.0, < 12.4.13 ≥ 13.0.0, < 13.0.11 ≥ 13.1.0, < 13.1.8 ≥ 13.2.0, < 13.2.4 |
— 12.4.13 13.0.11 13.1.8 13.2.4 |
Original description The description as published by the source.
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
References
- REDHAT Red Hat
- web nvd.nist.gov
- web security@grafana.com
- web github.com