CVE-2026-21724

Missing Protected-field Authorization in Provisioning Contact Points API

CVSS 5.4 MEDIUMEPSS 0.2%CWE-285

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.4EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

26 Mar 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected products

Grafana · Grafana OSS

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://grafana.com/security/security-advisories/cve-2026-21724