Authorization Bypass Allows Deleting Protected Contact Points in Grafana

Executive Summary

CVE-2026-72585 is an authorization bypass vulnerability in Grafana versions up to 13.2.0. It allows users with the Editor role to delete protected contact points (alert receivers) without the required alert.notifications.receivers.protected:write permission. The issue stems from missing authorization checks in the DELETE operation path for contact points, while previous fixes for CVE-2026-21724 only addressed UPDATE operations.

Useful 0 Not Useful 0

Detection Guidance

Check Grafana logs for unauthorized DELETE operations on contact points by Editors. Review API access logs for requests to /api/v1/provisioning/contact-points with DELETE method targeting protected receivers. Use Grafana's built-in audit logging if enabled to track permission violations.

Useful 0 Not Useful 0

Impact Analysis

An attacker with Editor role privileges could delete critical alert receivers, disrupting monitoring and alerting systems. This could lead to missed alerts for security incidents or system failures, potentially causing delayed responses to operational issues. The impact is limited to unauthorized deletion of configurations but does not directly expose data or grant elevated privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by disrupting required alerting mechanisms for data breaches or system failures. For GDPR, missed security alerts may delay breach notifications. For HIPAA, it could prevent timely alerts for unauthorized access or system outages. Organizations must ensure alerting systems remain functional to meet regulatory monitoring requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Grafana to a patched version addressing CVE-2026-72585. Temporarily restrict Editor role permissions to prevent contact point modifications. Monitor for suspicious DELETE operations on protected contact points until patched.

Useful 0 Not Useful 0