CVE-2026-9765 describes a broken access control vulnerability in Grafana IRM version 1.0.0. The issue permits attackers with some level of access to bypass authorization checks, enabling unauthorized access to restricted resources and potentially performing actions on behalf of other users. The CVSS 3.1 base score is 7.1, reflecting high severity with network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. No official patch or remediation level has been provided by the vendor. The vulnerability is not associated with a cloud service and no known exploits have been reported.

An attacker exploiting this vulnerability can bypass access control mechanisms to access resources they are not authorized to view or modify. This can result in unauthorized data exposure, unauthorized operations performed on behalf of other users, potential account takeover, and privilege escalation. The integrity of the system is highly impacted, while confidentiality is not affected and availability impact is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to the affected version and consider additional compensating controls to limit unauthorized access where possible.