CVE-2026-92539: CVE-2026-92539: güvenlik açığı

Açıklama (NVD)

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.

Özet bilgiler

CVSS v3.1

6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

EPSS

%0,34 (yüzdelik 27)

CWE

CWE-639

Yama

Yok / bilinmiyor

Kaynaklar

• NVD kaydı
• grafana.com
• CWE-639