|
Vulnerabilities
< Back

CVE-2026-21724

Updated on 26 Mar 2026

Severity

4.3 Medium severity

Details

CVSS score
4.3
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.

Details

Affected product:
Alpine Linux 3.22 , Debian 12 , Debian 13
Affected packages:
grafana @ 11.4 (+11 more)
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.