EUVD-2026-48568
GHSA-4cgr-9q8v-9x3m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Primary rating from Vendor (GRAFANA) · only source for this CVE.
CVSS VectorVendor: GRAFANA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Lifecycle Timeline
2DescriptionCVE.org
Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue.
Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions.
Broken access control can allow attackers to: Access resources only accessible to certain users, thus allowing unauthorized access to data Perform operations on behalf of other users, leading to account takeovers in the worst cases Attempt privilege escalation Attempt to take over an account
AnalysisAI
Privilege escalation and unauthorized data modification in the Grafana IRM cloud service allowed authenticated low-privilege users to perform operations on behalf of other users due to broken access controls, potentially leading to account takeover. The vulnerability affected cloud-only deployments of versions 1.0.0 through 1.164.0 and has been automatically resolved; self-hosted environments are not impacted. The EPSS exploitation probability is low (0.29%) and no active exploitation is known.
Same weakness CWE-284 – Improper Access Control
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today