CVE-2026-92539
6.7 MEDIUMPublished 2026-10-20 · Updated 2026-10-20
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
Weaknesses
CWE-639, CWE-863, CWE-1220
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-78433PoC
- MEDIUMCVE-2026-102139PoC
- MEDIUMCVE-2026-105268PoC
- HIGHCVE-2026-110724PoC
- MEDIUMCVE-2026-52743PoC
- MEDIUMCVE-2026-55625PoC
- HIGHCVE-2026-61726PoC
- MEDIUMCVE-2026-61744PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.