Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2026-21724

Missing Protected-field Authorization in Provisioning Contact Points API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Grafana OSS

Default version status: unaffected

  • 12.3.1 to < 12.3.6affected
  • 12.2.2 to < 12.2.8affected
  • 12.1.5 to < 12.1.10affected
  • 11.6.9 to < 11.6.14affected

References