CVE-2026-21724 — Missing Protected-field Authorization in Provisioning Contact Points API

CVE-2026-21724

Missing Protected-field Authorization in Provisioning Contact Points API PUBLISHED

Description (CNA)

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.

Affected (CNA)

Vendor / product	Versions
Grafana / Grafana OSS	affected 12.3.1 before 12.3.6; affected 12.2.2 before 12.2.8; affected 12.1.5 before 12.1.10; affected 11.6.9 before 11.6.14

CWE

No CWE identifiers supplied.

References

https://grafana.com/security/security-advisories/cve-2026-21724

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.