CVE-2026-92539
MEDIUM 6.7A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 27th percentile
Impact if exploited
6.7CVSS 3.1 · MEDIUM
- ConfidentialityLow
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires an admin / high-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-639: Authorization bypass
- CWE-863: Incorrect authorization
- CWE-1220: Insufficient Granularity of Access Control
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
References and research data (JSON)
Vendor product assessments
Showing 32 of 37 vendor product statements; 5 omitted. Read the full vendor advisory.
grafana12.4-0:12.4.13-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana12.4-0:12.4.13-0.1.hum1@src as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana12.4-0:12.4.13-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.1-0:13.1.8-0.3.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.1-0:13.1.8-0.3.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.1-0:13.1.8-0.3.hum1@src as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.1-0:13.1.8-0.3.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.2-0:13.2.4-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.2-0:13.2.4-0.1.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.2-0:13.2.4-0.1.hum1@src as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
grafana13.2-0:13.2.4-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
multicluster-globalhub/multicluster-globalhub-grafana-rhel9 as a component of Multicluster Global Hub · known affected
Vendor assessment for this product only.
pkg:oci/multicluster-globalhub-grafana-rhel9@sha256:7092341d99cdb2da484f2770c94c48f0fc38e1c3f59c854ad7bdea0e6db8aa73?repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9
- none available: Fix deferred
rhacm2/acm-grafana-rhel9 as a component of Red Hat Advanced Cluster Management for Kubernetes 2 · known affected
Vendor assessment for this product only.
pkg:oci/acm-grafana-rhel9@sha256:aa7ca316ec068e466c4a413b83b3f24a26653dc2c63497a5f6f48a8cc44c36c7?repository_url=registry.redhat.io/rhacm2/acm-grafana-rhel9
- none available: Fix deferred
rhceph/grafana-rhel9 as a component of Red Hat Ceph Storage 7 · known affected
Vendor assessment for this product only.
pkg:oci/grafana-rhel9@sha256:9855523cf71d68a3f6d04db0d7cd57dd811549db83cea9b48b340dbc8cecfeb5?repository_url=registry.redhat.io/rhceph/grafana-rhel9
- none available: Fix deferred
rhceph/grafana-rhel10 as a component of Red Hat Ceph Storage 9 · known affected
Vendor assessment for this product only.
pkg:oci/grafana-rhel10@sha256:04469a55551c52b0c535bee8734003b4ada037bf47ec298c521e12379cdcae69?repository_url=registry.redhat.io/rhceph/grafana-rhel10
- no fix planned: Out of support scope
grafana as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana
- none available: Fix deferred
grafana-selinux as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-selinux
- none available: Fix deferred
grafana as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana
- none available: Fix deferred
grafana-azure-monitor as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-azure-monitor
- none available: Fix deferred
grafana-cloudwatch as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-cloudwatch
- none available: Fix deferred
grafana-elasticsearch as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-elasticsearch
- none available: Fix deferred
grafana-graphite as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-graphite
- none available: Fix deferred
grafana-loki as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-loki
- none available: Fix deferred
grafana-mssql as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-mssql
- none available: Fix deferred
grafana-mysql as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-mysql
- none available: Fix deferred
grafana-postgres as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-postgres
- none available: Fix deferred
grafana-prometheus as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-prometheus
- none available: Fix deferred
grafana-selinux as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-selinux
- none available: Fix deferred
grafana-stackdriver as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-stackdriver
- none available: Fix deferred
grafana.src as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana?arch=src
- none available: Fix deferred
grafana-selinux as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana-selinux
- none available: Fix deferred
grafana.src as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/grafana?arch=src
- none available: Fix deferred
All CVSS metrics
- MEDIUM 6.7 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H - MEDIUM 6.7 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
References
Advisories
- https://grafana.com/security/security-advisories/cve-2026-92539 CVE record · GRAFANA · Updated 2026-10-20T16:55:17.875Z
NVD · CVE-2026-92539 · Updated 2026-10-20T20:06:37.150
Red Hat · CVE-2026-92539 · Updated 2026-10-21T19:42:03+00:00 - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92539.json Red Hat · CVE-2026-92539 · Updated 2026-10-21T19:42:03+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105187 EUVD · EUVD-2026-105187
Technical & other
- https://access.redhat.com/security/cve/CVE-2026-92539 Red Hat · CVE-2026-92539 · Updated 2026-10-21T19:42:03+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2556381 Red Hat · CVE-2026-92539 · Updated 2026-10-21T19:42:03+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-92539 Red Hat · CVE-2026-92539 · Updated 2026-10-21T19:42:03+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-92539 Red Hat · CVE-2026-92539 · Updated 2026-10-21T19:42:03+00:00
- https://access.redhat.com/errata/RHSA-2026:85295 Red Hat · CVE-2026-92539 · Updated 2026-10-21T19:42:03+00:00
- https://access.redhat.com/errata/RHSA-2026:87077 Red Hat · CVE-2026-92539 · Updated 2026-10-21T19:42:03+00:00
- https://access.redhat.com/errata/RHSA-2026:85544 Red Hat · CVE-2026-92539 · Updated 2026-10-21T19:42:03+00:00