Executive brief
Grafana OSS, a popular data visualization and monitoring platform, contains a security flaw in how it handles alert notifications. Users with the 'Editor' role can bypass intended security restrictions to modify protected webhook URLs, which are used to send alerts to external systems. This could allow an internal user to redirect sensitive alert data to an unauthorized destination or disrupt incident response workflows.
Technical details
An improper authorization vulnerability (CWE-285) exists in the Grafana OSS provisioning contact points API. The root cause is a missing authorization check for protected fields when updating contact points. An attacker with 'Editor' role privileges can exploit this via the network to modify webhook URLs that should be restricted by the 'alert.notifications.receivers.protected:write' permission. This allows unauthorized modification of alerting configurations. The issue is fixed in versions 11.6.14, 12.1.10, 12.2.8, and 12.3.6.
Affected products
- Grafana Labs Grafana OSS >= 11.6.9, < 11.6.14; >= 12.1.5, < 12.1.10; >= 12.2.2, < 12.2.8; >= 12.3.1, < 12.3.6
Timeline
- 2026-03-23: patched: Fix committed to repository
- 2026-03-25: advisory: Vendor advisory published
- 2026-03-26: disclosed: CVE-2026-21724 published