CVE-2026-21724

Missing Protected-field Authorization in Provisioning Contact Points API

Medium · published March 26, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
17.2
In the wild
Unconfirmed
What it is

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00263 · 17.2th percentile
Published
2026-03-26T20:06Z
EPSS history
Timeline
  • 26 MAR 20:06Z
    Missing Protected-field Authorization in Provisioning Contact Points API
    cvelistv5