BIT-grafana-2026-21724

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2026-21724.json

JSON Data

https://api.test.osv.dev/v1/vulns/BIT-grafana-2026-21724

Aliases

Published

2026-04-06T07:50:18Z

Modified

2026-09-08T08:47:28Z

Summary

Missing Protected-field Authorization in Provisioning Contact Points API

Details

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.

Database specific

{
    "cpes":  [
        "cpe:2.3:a:grafana:grafana:*:*:*:*:*:go:*:*"
    ],
    "severity":  "Medium"
}

References

Affected packages

Bitnami / grafana

Package

Name: grafana
Purl: pkg:bitnami/grafana

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

11.6.9

Fixed

11.6.14

Introduced

12.1.5

Fixed

12.1.10

Introduced

12.2.2

Fixed

12.2.8

Introduced

12.3.1

Fixed

12.3.6

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2026-21724.json"