CVE-2026-9765: CVE-2026-9765 CVE Record

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-24 · updated 2026-10-24
Weakness: CWE-284

Description

Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. Broken access control can allow attackers to: Access resources only accessible to certain users, thus allowing unauthorized access to data Perform operations on behalf of other users, leading to account takeovers in the worst cases Attempt privilege escalation Attempt to take over an account

Affected products

Grafana IRM: from 1.0.0 through 1.164.0

References

https://grafana.com/security/security-advisories/cve-2026-9765

Get alerted when CVE-2026-9765 or the next vulnerability affects your stack