CVE-2026-92539

The Grafana Enterprise instance is vulnerable to cross-organization user management manipulation when the SCIM API is enabled. Due to an insecure direct object reference , a service account with user-management permissions in one organization can read, modify, disable, or delete users belonging t...