CVE-2026-9765 affects Grafana IRM version 1.0.0 and is categorized as a broken access control vulnerability (CWE-284). It enables attackers with some privileges to bypass access control restrictions, potentially accessing unauthorized resources, performing operations on behalf of other users, escalating privileges, or taking over accounts. The CVSS v3.1 base score is 7.1, reflecting a high severity with network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. The vulnerability is not related to a cloud service and no official remediation or patch is currently documented.

The vulnerability allows unauthorized access to resources and operations restricted by access controls in Grafana IRM 1.0.0. This can lead to unauthorized data exposure, integrity violations through unauthorized actions, and potential account compromises. The integrity impact is high, while confidentiality is not affected. Availability impact is low. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Grafana's advisories for updates. Until a fix is available, limit user privileges and review access control configurations carefully to reduce risk.