Medium severity5.4NVD Advisory· Published Mar 26, 2026· Updated Apr 14, 2026
CVE-2026-21724
CVE-2026-21724
Description
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/grafana/grafanaGo | < 1.9.2-0.20260323180334-daffe750de85 | 1.9.2-0.20260323180334-daffe750de85 |
Affected products
16- osv-coords15 versionspkg:apk/chainguard/grafana-fips-12.1pkg:apk/chainguard/grafana-fips-12.2pkg:apk/chainguard/grafana-fips-12.3pkg:bitnami/grafanapkg:golang/github.com/grafana/grafanapkg:rpm/opensuse/grafana&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/grafana&distro=openSUSE%20Tumbleweedpkg:rpm/suse/golang-github-lusitaniae-apache_exporter&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-15pkg:rpm/suse/golang-github-prometheus-prometheus&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-15pkg:rpm/suse/grafana&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-15pkg:rpm/suse/prometheus-blackbox_exporter&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-15pkg:rpm/suse/prometheus-blackbox_exporter&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-Micro-5pkg:rpm/suse/spacecmd&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-15pkg:rpm/suse/uyuni-tools&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-15pkg:rpm/suse/uyuni-tools&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-Micro-5
< 12.1.10.01-r0+ 14 more
- (no CPE)range: < 12.1.10.01-r0
- (no CPE)range: < 12.2.8.01-r0
- (no CPE)range: < 12.3.6.01-r0
- (no CPE)range: >= 11.6.9, < 11.6.14
- (no CPE)range: < 1.9.2-0.20260323180334-daffe750de85
- (no CPE)range: < 11.6.14+security04-bp160.1.1
- (no CPE)range: < 11.6.14+security01-1.1
- (no CPE)range: < 1.0.10-150002.3.6.1
- (no CPE)range: < 3.5.0-150002.3.8.1
- (no CPE)range: < 11.6.14+security01-150002.4.14.1
- (no CPE)range: < 0.26.0-150002.3.6.1
- (no CPE)range: < 0.26.0-150002.3.6.1
- (no CPE)range: < 5.1.13-150002.3.9.3
- (no CPE)range: < 5.1.26-150002.3.12.1
- (no CPE)range: < 5.1.26-150002.3.12.1
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-7g92-g4vh-hp84ghsaADVISORY
- grafana.com/security/security-advisories/cve-2026-21724nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-21724ghsaADVISORY
- github.com/grafana/grafana/commit/daffe750de85b0dbf79f206a35835cf66a83d6caghsaWEB
- github.com/grafana/grafana/releases/tag/v12.3.6ghsaWEB
News mentions
0No linked articles in our index yet.