CVE-2026-9765

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9765", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-05-27T19:51:51.271Z", "datePublished": "2026-07-24T12:23:14.114Z", "dateUpdated": "2026-07-24T14:47:18.667Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-07-24T12:23:14.114Z"}, "datePublic": "2026-06-27T20:25:07.981Z", "title": "CVE-2026-9765 CVE Record", "descriptions": [{"lang": "en", "value": "Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue.\n\nAccess Controls are \u201cBroken\u201d when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. \n\nBroken access control can allow attackers to:\nAccess resources only accessible to certain users, thus allowing unauthorized access to data\nPerform operations on behalf of other users, leading to account takeovers in the worst cases\nAttempt privilege escalation\nAttempt to take over an account"}], "affected": [{"vendor": "Grafana", "product": "Grafana IRM", "defaultStatus": "unaffected", "versions": [{"version": "1.0.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "1.164.0"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-9765", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"}}], "source": {"discovery": "PEN_TEST"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "CWE-284 Improper Access Control"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-24T14:47:15.168863Z", "id": "CVE-2026-9765", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-24T14:47:18.667Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-9765", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-24T14:47:15.168863Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-24T14:47:04.157Z"}}], "cna": {"title": "CVE-2026-9765 CVE Record", "source": {"discovery": "PEN_TEST"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"}}], "affected": [{"vendor": "Grafana", "product": "Grafana IRM", "versions": [{"status": "affected", "version": "1.0.0", "versionType": "semver", "lessThanOrEqual": "1.164.0"}], "defaultStatus": "unaffected"}], "datePublic": "2026-06-27T20:25:07.981Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-9765", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue.\n\nAccess Controls are \u201cBroken\u201d when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. \n\nBroken access control can allow attackers to:\nAccess resources only accessible to certain users, thus allowing unauthorized access to data\nPerform operations on behalf of other users, leading to account takeovers in the worst cases\nAttempt privilege escalation\nAttempt to take over an account"}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-07-24T12:23:14.114Z"}}}, "cveMetadata": {"cveId": "CVE-2026-9765", "state": "PUBLISHED", "dateUpdated": "2026-07-24T14:47:18.667Z", "dateReserved": "2026-05-27T19:51:51.271Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-07-24T12:23:14.114Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana IRM", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "1.164.0", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue.\n\nAccess Controls are \u201cBroken\u201d when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. \n\nBroken access control can allow attackers to:\nAccess resources only accessible to certain users, thus allowing unauthorized access to data\nPerform operations on behalf of other users, leading to account takeovers in the worst cases\nAttempt privilege escalation\nAttempt to take over an account"}, {"lang": "es", "value": "Nota: El CVE y la publicaci\u00f3n del blog no existen porque determinamos que esto es en realidad un problema exclusivo de la nube.\n\nLos controles de acceso est\u00e1n \u2019rotos\u2019 cuando un usuario puede acceder a recursos a los que no est\u00e1 autorizado a acceder. Un atacante puede eludir cualquier mecanismo de control de acceso en una aplicaci\u00f3n web y obtener acceso no autorizado a recursos que no est\u00e1n disponibles con sus permisos.\n\nEl control de acceso roto puede permitir a los atacantes:\nAcceder a recursos solo accesibles para ciertos usuarios, permitiendo as\u00ed el acceso no autorizado a datos\nRealizar operaciones en nombre de otros usuarios, lo que lleva a la toma de control de cuentas en los peores casos\nIntentar la escalada de privilegios\nIntentar tomar el control de una cuenta"}], "id": "CVE-2026-9765", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security@grafana.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9765", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-24T14:47:15.168863Z", "version": "2.0.3"}}]}, "published": "2026-07-24T13:18:31.480", "references": [{"source": "security@grafana.com", "url": "https://grafana.com/security/security-advisories/cve-2026-9765"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,1.164.0]"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "Grafana IRM", "source": "cna", "vendor": "Grafana"}, "product": "grafana", "vendor": "grafana"}], "created": "2026-07-27T15:23:35.343676+00:00", "title": "Broken Access Control in Grafana IRM Allowing Unauthorized Resource Access", "updated": "2026-08-03T20:30:04.550192+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana"]}