GitHub Advisoryadvisory · Go

GHSA-7g92-g4vh-hp84 Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions

MEDIUM Published 2026-03-26 Modified 2026-07-21 Official page ↗
Aliases
CVE-2026-21724
Ecosystem
Go
Packages
github.com/grafana/grafana
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-285
Reviewed
2026-04-23

Affected packages

• Go github.com/grafana/grafana: < 1.9.2-0.20260323180334-daffe750de85 → fixed in 1.9.2-0.20260323180334-daffe750de85

Description

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission. A patched version is available at https://github.com/grafana/grafana/releases/tag/v12.3.6.

Related

Alias · CVE (1)

  • CVE-2026-21724 A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with… vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References