PT-2026-28321 · Grafana+1 · Grafana Oss+2
CVE-2026-21724
·
Published
2026-03-26
·
Updated
2026-08-10
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Grafana OSS versions prior to 12.3.6
Description
An authorization bypass exists in the provisioning contact points API. This issue allows users with the Editor role to modify protected webhook URLs without possessing the necessary
alert.notifications.receivers.protected:write permission.Recommendations
Update to version 12.3.6.
Exploit
Fix
Improper Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Grafana
Grafana Oss
Red Os