CVE-2026-92539: Grafana Enterprise SCIM Auth Bypass Flaw

CVE-2026-92539 Overview

CVE-2026-92539 is an insecure direct object reference (IDOR) vulnerability in the Grafana Enterprise System for Cross-domain Identity Management (SCIM) API. A service account that holds user-management permissions within one organization can read, modify, disable, or delete users belonging to other organizations hosted on the same Grafana instance. The flaw affects only Grafana Enterprise deployments with SCIM enabled. Successful exploitation breaks tenant isolation across organizations sharing a Grafana instance and gives an authenticated attacker control over user accounts outside the attacker's authorization boundary. The weakness is tracked as CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
A compromised or malicious service account in one Grafana organization can take over, disable, or delete user accounts in other organizations on the same instance via the SCIM API.

Affected Products

Grafana Enterprise instances with SCIM provisioning enabled
Multi-organization Grafana Enterprise deployments
Service accounts granted user-management permissions through SCIM

Discovery Timeline

2026-10-20 - CVE CVE-2026-92539 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-92539

Vulnerability Analysis

The vulnerability resides in the Grafana SCIM API, which handles automated user and group provisioning for Grafana Enterprise. SCIM endpoints accept user identifiers supplied by the caller and apply operations such as read, update, disable, or delete. The API fails to verify that the referenced user belongs to the same organization as the authenticated service account. As a result, a caller can substitute any user identifier known to the instance and act on that account.

This is a textbook insecure direct object reference. The authorization check confirms that the service account can perform SCIM operations in its own organization but does not scope the target object to that organization. The flaw yields high integrity and availability impact because an attacker can disable or delete arbitrary users. Confidentiality impact is limited to data exposed through SCIM user records.

Root Cause

The root cause is missing object-level authorization on SCIM user endpoints. Grafana Enterprise supports multiple organizations within a single instance, but the SCIM handler trusts the user ID in the request path without validating cross-organization boundaries. Service account permissions are enforced at the API layer rather than against the specific target user.

Attack Vector

Exploitation requires an authenticated service account token with SCIM user-management permissions in at least one organization on the target instance. The attacker issues SCIM HTTP requests referencing user IDs that belong to a different organization. The server executes the operation without rejecting the cross-tenant reference. Attack prerequisites include network access to the Grafana API and valid high-privilege credentials, which places this scenario in the insider or compromised-credential threat model.

No verified exploit code is published for this issue. See the Grafana Security Advisory CVE-2026-92539 for vendor technical details.

Detection Methods for CVE-2026-92539

Indicators of Compromise

SCIM API requests (/apis/scim.grafana.app/) where the authenticated service account's organization does not match the organization of the referenced user ID.
Unexpected DELETE, PATCH, or PUT operations against SCIM user resources outside normal provisioning windows.
Users in one organization being disabled, modified, or removed without a corresponding change in the upstream identity provider for that organization.

Detection Strategies

Correlate SCIM API audit logs with the authenticated service account's organization membership and alert on cross-organization targets.
Baseline SCIM traffic volume per service account and flag deviations in user mutation operations.
Review Grafana audit logs for user lifecycle events (user.create, user.update, user.delete) initiated by service accounts rather than identity provider syncs.

Monitoring Recommendations

Forward Grafana audit logs to a centralized SIEM and retain SCIM API calls with full request metadata.
Alert on any SCIM operation performed by a service account against a user that was not previously provisioned by that service account.
Monitor service account token usage for unusual source IPs or off-hours activity.

How to Mitigate CVE-2026-92539

Immediate Actions Required

Upgrade affected Grafana Enterprise instances to the fixed release listed in the Grafana Security Advisory CVE-2026-92539.
Audit all service accounts with SCIM user-management permissions and revoke those that do not require it.
Rotate SCIM service account tokens after patching to invalidate any credentials that may have been exposed.
Review user and group changes performed through the SCIM API since SCIM was enabled.

Patch Information

Grafana Labs has published fixed versions in its security advisory. Operators of Grafana Enterprise with SCIM enabled should apply the vendor-supplied patch for CVE-2026-92539 as the primary remediation. Refer to the Grafana Security Advisory CVE-2026-92539 for exact fixed version numbers and upgrade guidance.

Workarounds

Disable SCIM provisioning on affected instances until the patch can be applied if the feature is not business-critical.
Restrict network access to the Grafana SCIM API endpoints to trusted identity provider source ranges only.
Segregate tenants onto separate Grafana Enterprise instances rather than sharing an instance across organizations when strict isolation is required.

bash

# Configuration example: disable SCIM in grafana.ini until patched
[auth.scim]
user_sync_enabled = false
group_sync_enabled = false