CVE-2026-92539

A flaw was found in Grafana. An authenticated service account with user-management permissions in one organization can access users in other organizations on the same instance due to missing access controls in the System for Cross-domain Identity Management (SCIM) API. This allows an authorized account to view, modify, disable, or delete users belonging to separate organizations, breaking tenant isolation.

This issue is rated Moderate. On Grafana Enterprise with SCIM enabled, a service account with user-management rights in one organization can read, modify, disable, or delete users in other organizations through the SCIM API, breaking tenant isolation. Confidentiality impact is limited; integrity and availability of user accounts can be high within the instance. Red Hat products ship Grafana OSS and do not include Grafana Enterprise SCIM, so Red Hat product builds are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Not applicable to Red Hat product builds, which do not ship Grafana Enterprise SCIM. If you run upstream Grafana Enterprise with SCIM, restrict SCIM and user-management credentials to highly trusted service accounts, isolate the Grafana management plane. Prefer separate Grafana instances per tenant when strong isolation is required.