BIT-grafana-2026-92539

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2026-92539.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-grafana-2026-92539

Aliases

CVE-2026-92539

Published

2026-10-29T08:46:52Z

Modified

2026-10-29T10:45:06Z

Summary

Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise

Details

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.

Database specific

{
    "cpes":  [
        "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:go:*:*"
    ],
    "severity":  "Medium"
}

References

Affected packages

Bitnami / grafana

Package

Name: grafana
Purl: pkg:bitnami/grafana

Severity

6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

11.6.0

Fixed

12.4.13

Introduced

13.0.0

Fixed

13.0.11

Introduced

13.1.0

Fixed

13.1.8

Introduced

13.2.0

Fixed

13.2.4

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2026-92539.json"