EUVD-2026-16338
GHSA-7g92-g4vh-hp84
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.
AnalysisAI
Grafana OSS provisioning contact points API fails to enforce the alert.notifications.receivers.protected:write permission, allowing users with the Editor role to modify protected webhook URLs and bypass intended authorization controls. This affects Grafana OSS versions 11.6.9 through 11.6.14, 12.1.5 through 12.1.10, 12.2.2 through 12.2.8, and 12.3.1 through 12.3.6. Authenticated Editor-level users can exploit this to reconfigure webhook destinations, potentially redirecting alert notifications to attacker-controlled endpoints. No public exploit identified at time of analysis.
Technical ContextAI
The vulnerability resides in Grafana OSS (cpe:2.3:a:grafana:grafana_oss:*:*:*:*:*:*:*:*) provisioning API layer, which manages contact point configurations for alerting and notification workflows. The root cause is an authorization bypass where the API endpoint responsible for modifying contact points-specifically protected webhook URLs-does not validate the alert.notifications.receivers.protected:write permission before processing requests. This represents a privilege escalation mechanism: the API fails to enforce fine-grained role-based access control (RBAC) rules and instead allows any user with the Editor role (a lower privilege tier) to perform administrative actions reserved for users with explicit notification receiver modification permissions. The vulnerability does not involve cryptographic failure or input validation flaws, but rather a control flow defect where permission checks are either absent or conditionally applied.
RemediationAI
Upgrade Grafana OSS to patched versions above the affected ranges: version 11.6.14 or later for the 11.6.x line, version 12.1.10 or later for the 12.1.x line, version 12.2.8 or later for the 12.2.x line, and version 12.3.6 or later for the 12.3.x line. Consult the vendor security advisory at https://grafana.com/security/security-advisories/cve-2026-21724 for definitive patched versions and release dates. Until patching is feasible, restrict the Editor role assignment to trusted users only, audit current Editor role membership, and implement network-level access controls limiting provisioning API endpoints to administrative networks. Additionally, review webhook URL configurations in provisioning contact points to detect any unauthorized modifications and consider implementing API request logging to monitor contact point changes for anomalies.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| SUSE Manager Client Tools 15 | Fixed |
| SUSE Manager Client Tools for SLE 15 | Fixed |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
| SUSE Multi Linux Manager Tools SLE-15 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today