CVE-2026-9765

{
  "id": "CVE-2026-9765",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-24T13:18:31.480",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue.\n\nAccess Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. \n\nBroken access control can allow attackers to:\nAccess resources only accessible to certain users, thus allowing unauthorized access to data\nPerform operations on behalf of other users, leading to account takeovers in the worst cases\nAttempt privilege escalation\nAttempt to take over an account"
    },
    {
      "lang": "es",
      "value": "Nota: El CVE y la publicación del blog no existen porque determinamos que esto es en realidad un problema exclusivo de la nube.\n\nLos controles de acceso están ’rotos’ cuando un usuario puede acceder a recursos a los que no está autorizado a acceder. Un atacante puede eludir cualquier mecanismo de control de acceso en una aplicación web y obtener acceso no autorizado a recursos que no están disponibles con sus permisos.\n\nEl control de acceso roto puede permitir a los atacantes:\nAcceder a recursos solo accesibles para ciertos usuarios, permitiendo así el acceso no autorizado a datos\nRealizar operaciones en nombre de otros usuarios, lo que lleva a la toma de control de cuentas en los peores casos\nIntentar la escalada de privilegios\nIntentar tomar el control de una cuenta"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Grafana",
          "product": "Grafana IRM",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1.0.0",
              "lessThanOrEqual": "1.164.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-24T14:47:15.168863Z",
          "id": "CVE-2026-9765",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://grafana.com/security/security-advisories/cve-2026-9765",
      "source": "[email protected]"
    }
  ]
}