CVE-2026-21724
Received Received - Intake
Authorization Bypass in Grafana OSS Provisioning Contact Points API

Publication date: 2026-03-26

Last updated on: 2026-04-14

Assigner: Grafana Labs

Description
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-26
Last Modified
2026-04-14
Generated
2026-06-16
AI Q&A
2026-03-26
EPSS Evaluated
2026-06-15
NVD
CVE-2026-21724
EUVD
EUVD-2026-16338
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
grafana grafana From 11.6.9 (inc) to 11.6.14 (exc)
grafana grafana From 12.1.5 (inc) to 12.1.10 (exc)
grafana grafana From 12.2.2 (inc) to 12.2.8 (exc)
grafana grafana From 12.3.1 (inc) to 12.3.6 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-21724 is a medium severity vulnerability in Grafana OSS involving an authorization bypass in the provisioning contact points API.

Specifically, users with the Editor role can modify protected webhook URLs without having the required permission alert.notifications.receivers.protected:write.

This means that the system's authorization controls are missing or insufficient, allowing unauthorized modification of sensitive configuration fields.

Impact Analysis

This vulnerability allows users with the Editor role to bypass authorization and modify protected webhook URLs, which are sensitive configuration settings.

Such unauthorized modifications could lead to potential misuse or manipulation of alerting mechanisms within Grafana.

The CVSS score indicates a low impact on confidentiality and integrity, and no impact on availability, but it still represents a security risk due to unauthorized access.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Grafana OSS to a fixed version. The vulnerability is fixed in versions 12.3.1 through 12.3.6, 12.2.2 through 12.2.8, 12.1.5 through 12.1.10, and 11.6.9 through 11.6.14.

Additionally, review and restrict the Editor role permissions to ensure that users do not have unauthorized access to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.

Compliance Impact

The vulnerability allows users with the Editor role to bypass authorization controls and modify protected webhook URLs without the required permission. This unauthorized modification of sensitive configuration fields could potentially lead to unauthorized data access or data leakage.

Such unauthorized access or modification of sensitive data configurations may impact compliance with standards and regulations like GDPR or HIPAA, which require strict access controls and protection of sensitive information.

However, the provided information does not explicitly state the direct impact on compliance with these regulations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-21724. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart