Grafana Access Control Bypass (CVE-2026-9765)
CVE-2026-9765 Published on July 24, 2026
CVE-2026-9765 CVE Record
Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue.
Access Controls are Broken when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions.
Broken access control can allow attackers to:
Access resources only accessible to certain users, thus allowing unauthorized access to data
Perform operations on behalf of other users, leading to account takeovers in the worst cases
Attempt privilege escalation
Attempt to take over an account
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2026-9765 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2026-9765
Want to know whenever a new CVE is published for Grafana Labs Grafana? stack.watch will email you.
Affected Versions
Grafana IRM:- Version 1.0.0, <= 1.164.0 is affected.