CVE-2026-21724
Authorization Bypass in Grafana OSS Provisioning Contact Points API
Publication date: 2026-03-26
Last updated on: 2026-04-14
Assigner: Grafana Labs
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| grafana | grafana | From 11.6.9 (inc) to 11.6.14 (exc) |
| grafana | grafana | From 12.1.5 (inc) to 12.1.10 (exc) |
| grafana | grafana | From 12.2.2 (inc) to 12.2.8 (exc) |
| grafana | grafana | From 12.3.1 (inc) to 12.3.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-21724 is a medium severity vulnerability in Grafana OSS involving an authorization bypass in the provisioning contact points API.
Specifically, users with the Editor role can modify protected webhook URLs without having the required permission alert.notifications.receivers.protected:write.
This means that the system's authorization controls are missing or insufficient, allowing unauthorized modification of sensitive configuration fields.
How can this vulnerability impact me? :
This vulnerability allows users with the Editor role to bypass authorization and modify protected webhook URLs, which are sensitive configuration settings.
Such unauthorized modifications could lead to potential misuse or manipulation of alerting mechanisms within Grafana.
The CVSS score indicates a low impact on confidentiality and integrity, and no impact on availability, but it still represents a security risk due to unauthorized access.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Grafana OSS to a fixed version. The vulnerability is fixed in versions 12.3.1 through 12.3.6, 12.2.2 through 12.2.8, 12.1.5 through 12.1.10, and 11.6.9 through 11.6.14.
Additionally, review and restrict the Editor role permissions to ensure that users do not have unauthorized access to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows users with the Editor role to bypass authorization controls and modify protected webhook URLs without the required permission. This unauthorized modification of sensitive configuration fields could potentially lead to unauthorized data access or data leakage.
Such unauthorized access or modification of sensitive data configurations may impact compliance with standards and regulations like GDPR or HIPAA, which require strict access controls and protection of sensitive information.
However, the provided information does not explicitly state the direct impact on compliance with these regulations.