CVE-2026-21724

MEDIUM5.4EPSS 0.02%

Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions

發布日:2026/3/26修改日:2026/4/23

也稱為:GHSA-7g92-g4vh-hp84BIT-grafana-2026-21724CGA-72xh-mq7m-f2g4

描述

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission. A patched version is available at https://github.com/grafana/grafana/releases/tag/v12.3.6.

受影響套件(2)

Bitnami/grafana>= 11.6.9, < 11.6.14, >= 12.1.5, < 12.1.10, >= 12.2.2, < 12.2.8, >= 12.3.1, < 12.3.6
Go/github.com/grafana/grafanafrom 0, < 1.9.2-0.20260323180334-daffe750de85

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

參考連結(5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-21724
PATCHhttps://github.com/grafana/grafana
WEBhttps://github.com/grafana/grafana/commit/daffe750de85b0dbf79f206a35835cf66a83d6ca
WEBhttps://github.com/grafana/grafana/releases/tag/v12.3.6
WEBhttps://grafana.com/security/security-advisories/cve-2026-21724