EUVD-2026-55221
GHSA-69w7-2qcg-cvr7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Editor-role credential required (PR:L); deletion of protected receivers causes high integrity loss with no confidentiality or availability impact.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
3DescriptionCVE.org
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points (receivers) without the required alert.notifications.receivers.protected:write permission. The fix for CVE-2026-21724 addressed only the UPDATE code path in both pkg/services/ngalert/provisioning/contactpoints.go and pkg/services/ngalert/notifier/receiver_svc.go, but the DELETE path in both receiver services was not updated with the protected-field check, leaving deletion operations unguarded.
AnalysisAI
Grafana through 13.2.0 contains an incomplete fix for CVE-2026-21724 that leaves protected alert contact point (receiver) deletion unguarded: an authenticated Editor-role user can DELETE any protected receiver without the required alert.notifications.receivers.protected:write permission. The prior fix patched only the UPDATE code path in contactpoints.go and receiver_svc.go, leaving the DELETE handler exposed in both files. With CVSS 6.5 (AV:N/AC:L/PR:L) and no public exploit identified at time of analysis, the immediate risk is moderate but operationally significant - silent deletion of protected notification channels can blind alerting pipelines and disrupt incident response.
Technical ContextAI
Grafana's unified alerting engine (ngalert) enforces a tiered permission model on contact points (receivers) - the notification channels used by alert rules to reach PagerDuty, Slack, email, and similar services. Certain receivers can be designated 'protected,' requiring the elevated alert.notifications.receivers.protected:write permission for modification. The fix for CVE-2026-21724 introduced a protected-field authorization check into the UPDATE handler of two Go service files - pkg/services/ngalert/provisioning/contactpoints.go and pkg/services/ngalert/notifier/receiver_svc.go - but the equivalent guard was never added to the DELETE handler in either file. CWE-284 (Improper Access Control) describes this root cause class precisely: the access control policy is enforced on some operations but not all semantically equivalent operations on the same resource. CPE cpe:2.3:a:grafana_labs:grafana:*:*:*:*:*:*:*:* covers all Grafana editions through 13.2.0.
RemediationAI
Upgrade Grafana to the first patched release that closes the DELETE-path authorization gap in both contactpoints.go and receiver_svc.go - no exact fixed version is confirmed from available input data, so monitor https://grafana.com/security/security-advisories/ for the dedicated CVE-2026-72585 advisory. As a compensating control prior to patching, audit all accounts holding the Editor role and remove it from any accounts that do not operationally require it, reducing the pool of potential exploiters; note this may affect legitimate alert management workflows. Additionally, enable Grafana audit logging and alert on DELETE calls to /api/v1/provisioning/contact-points/{uid} - this does not prevent deletion but provides detection and forensic coverage. If the Grafana provisioning API is not required for interactive users, restrict access to the provisioning endpoints via network policy or reverse proxy ACLs as an additional layer.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Affected |
| SUSE Manager Client Tools 15 | Affected |
| SUSE Manager Client Tools for SLE 15 | Affected |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.3 | Affected |
| openSUSE Leap 15.4 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
| SUSE Multi Linux Manager Tools SLE-15 | Affected |
| ses/7.1/ceph/grafana ses/7/ceph/grafana suse/multi-linux-manager/5.2/x86_64/monitoring-grafana | Affected |
Share
External POC / Exploit Code
Leaving vuln.today