Grafana Enterprise EUVD-2026-105187

Exploitable ONLY on Grafana Enterprise instances with the SCIM provisioning feature explicitly enabled (not the default and not present in Grafana OSS). The attacker must already possess a service account with user-management permissions in at least one organization on the instance; the flaw then lets that account reach users in other organizations via the SCIM API's unscoped direct object reference. Limiting factors: Enterprise licensing, non-default SCIM enablement, a pre-existing privileged service account token (PR:H), and practical relevance primarily to multi-organization/multi-tenant instances - single-org deployments have no cross-org victims to target. No end-user interaction is required.

This is a moderate-priority authorization flaw (CWE-639, IDOR) rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H, base 6.7) shows network-reachable, low-complexity exploitation requiring NO user interaction, but critically gated behind PR:H - the attacker must already hold a service account with user-management permissions in one organization. That high-privilege prerequisite, combined with the Enterprise-only + SCIM-enabled deployment constraint, substantially narrows the realistic attack surface. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this reads as a vendor-discovered/vendor-reported issue (Reported by: GRAFANA) disclosed through a coordinated advisory. The signals are internally consistent (no CVSS-vs-description conflict), but note the impact is weighted toward integrity and availability (I:H/A:H - modify/disable/delete users across tenants) with only limited confidentiality (C:L - read users). Primary risk is multi-tenant/cross-organization trust-boundary violation in shared Grafana Enterprise deployments, making it most material for MSPs or SaaS operators hosting multiple customer orgs on one instance; standalone single-org or OSS deployments are not exposed.

On a multi-tenant Grafana Enterprise instance with SCIM enabled, an attacker (or malicious tenant) holding a service account token with user-management permissions in Organization A issues SCIM API requests referencing user identifiers that belong to Organization B. Because the API fails to scope the object reference to the caller's organization, the attacker can read, modify, disable, or delete Organization B's users - enabling cross-tenant denial of access or account tampering. No public exploit code was identified in the provided data, and exploitation requires UI:N but a pre-existing privileged service account.