Grafana EUVD-2026-16338

The CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network-accessible attack surface with low complexity, requiring authenticated low-privilege credentials, and no user interaction. The moderate confidentiality and integrity impact reflects data exposure and modification capability without availability impact. The authentication requirement (PR:L) significantly narrows the threat model to insider actors or compromised Editor-level accounts. The CVSS score of 5.4 (medium severity) aligns with this profile: real-world risk depends on organizational deployment patterns and whether Editor role accounts are broadly distributed or tightly controlled. Unlike zero-day authorization bypasses, this is a specific API-level privilege escalation with predictable exploitation mechanics and no reported active exploitation or public POC as of analysis. The low attack complexity and lack of user interaction increase automatable exploitation likelihood. However, the requirement for authenticated access and the limited impact scope (notification redirection only, not full system compromise) place this below critical priority for most organizations, though security-sensitive deployments with strict notification integrity requirements should treat this as high priority.

An attacker with a compromised or insider Editor-level account authenticates to the Grafana instance and sends a PUT or POST request directly to the provisioning contact points API endpoint with a modified webhook URL pointing to an attacker-controlled server. Because the API fails to validate the alert.notifications.receivers.protected:write permission, the request succeeds, and subsequent alert notifications are sent to the attacker's endpoint instead of the intended recipient. The attacker observes sensitive alert data (system metrics, security events) in real time and can suppress legitimate notifications to the security team, masking incident response activity.