CVE-2026-21724

4.3 mediumEPSS 0.3%

Medium (4.3) in grafana grafana. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/grafana/grafana 1.9.2-0.20260323180334-daffe750de85.

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
CWE: CWE-285
Published: 2026-03-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

grafana:grafana

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-7g92-g4vh-hp84	Go	github.com/grafana/grafana	<1.9.2-0.20260323180334-daffe750de85	1.9.2-0.20260323180334-daffe750de85
GO-2026-5219	Go	github.com/grafana/grafana	all versions	no fix published

References

https://grafana.com/security/security-advisories/cve-2026-21724

Check your stack JSON