GHSA-7g92-g4vh-hp84
Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions
At a glance
- Published
- Updated
- CVE
- CVE-2026-21724
- Aliases
- BIT-grafana-2026-21724, GO-2026-5219
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Description
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission. A patched version is available at https://github.com/grafana/grafana/releases/tag/v12.3.6.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/grafana/grafana | introduced 0, fixed 1.9.2-0.20260323180334-daffe750de85 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-21724 ADVISORY
- https://github.com/grafana/grafana/commit/daffe750de85b0dbf79f206a35835cf66a83d6ca WEB
- https://github.com/advisories/GHSA-7g92-g4vh-hp84 ADVISORY
- https://github.com/grafana/grafana PACKAGE
- https://github.com/grafana/grafana/releases/tag/v12.3.6 WEB
- https://grafana.com/security/security-advisories/cve-2026-21724 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |