medium5.4
CVE-2026-21724
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify…
Impact
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/grafana/grafana | < 1.9.2-0.20260323180334-daffe750de85 | 1.9.2-0.20260323180334-daffe750de85 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Grafana | Grafana | from 11.6.9 before 11.6.14 from 12.1.5 before 12.1.10 from 12.2.2 before 12.2.8 from 12.3.1 before 12.3.6 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-7g92-g4vh-hp84
- https://nvd.nist.gov/vuln/detail/CVE-2026-21724
- https://grafana.com/security/security-advisories/cve-2026-21724
- https://github.com/grafana/grafana/commit/daffe750de85b0dbf79f206a35835cf66a83d6ca
- https://github.com/grafana/grafana/releases/tag/v12.3.6