GHSA-7g92-g4vh-hp84

Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-21724

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/grafana/grafana	< 1.9.2-0.20260323180334-daffe750de85	1.9.2-0.20260323180334-daffe750de85

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission. A patched version is available at https://github.com/grafana/grafana/releases/tag/v12.3.6.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-21724 advisory
https://github.com/grafana/grafana/commit/daffe750de85b0dbf79f206a35835cf66a83d6ca web
https://github.com/advisories/GHSA-7g92-g4vh-hp84 advisory
https://github.com/grafana/grafana package
https://github.com/grafana/grafana/releases/tag/v12.3.6 web
https://grafana.com/security/security-advisories/cve-2026-21724 web