PT-2026-28321 · Grafana+1 · Grafana Oss+2

CVE-2026-21724

·

Published

2026-03-26

·

Updated

2026-08-10

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Grafana OSS versions prior to 12.3.6
Description An authorization bypass exists in the provisioning contact points API. This issue allows users with the Editor role to modify protected webhook URLs without possessing the necessary alert.notifications.receivers.protected:write permission.
Recommendations Update to version 12.3.6.

Exploit

Fix

Improper Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2026-07792
BIT-GRAFANA-2026-21724
CVE-2026-21724
GHSA-7G92-G4VH-HP84
GO-2026-5219
OPENSUSE-SU-2026:10601-1
OPENSUSE-SU-2026:20940-1
OPENSUSE-SU-2026:21483-1
SUSE-SU-2026:1524-1
SUSE-SU-2026:2243-1
SUSE-SU-2026:2258-1
SUSE-SU-2026:2265-1

Affected Products

Grafana
Grafana Oss
Red Os