CVE-2026-21724
Medium · 5.4CVSS
5.4
EPSS
0.3%
Published
Mar 26, 2026
CISA due date
—
The record
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | grafana | 0 | 11.6.14+security04-bp160.1.1 |
| openSUSE:Tumbleweed | grafana | 0 | 11.6.14+security01-1.1 |
Related vulnerabilities
- CVE-2026-27136 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects grafana
- CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that… Also affects grafana
- CVE-2026-42506 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects grafana
- CVE-2026-42502 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects grafana
- CVE-2026-25681 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects grafana
- CVE-2026-25680 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of… Also affects grafana
- CVE-2026-28380 Any Editor could delete any snapshot, even if they have no access to read or write them. Also affects grafana
- CVE-2026-28383 A request to the Grafana plugin resources endpoint can cause unbounded memory allocation… Also affects grafana