BIT-grafana-2026-21724

vendorUSosv

Missing Protected-field Authorization in Provisioning Contact Points API

view advisory published 2026-04-06Licence: per source

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-21724US	medium4.3	0.27% (20th)	—	2026-03-26
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook UR…

references

External citations — patches, advisories, analysis.

https://grafana.com/security/security-advisories/cve-2026-21724ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-21724WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan