CVE-2026-21724Medium· 5.4▾ SunlitGrafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.2%
0.2% → 0.3%
Last analysed / modified upstream
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.
A patched version is available at https://github.com/grafana/grafana/releases/tag/v12.3.6.
github.com/grafana/grafana < 1.9.2-0.20260323180334-daffe750de85Upgrade to a patched release:
github.com/grafana/grafana 1.9.2-0.20260323180334-daffe750de85Connected by shared product, vendor, weakness, or advisory.
CVE-2023-22462Medium· 6.4Grafana vulnerable to Stored Cross-site Scripting in Text plugin
CVE-2020-13430Medium· 6.1Grafana XSS via the OpenTSDB datasource
CVE-2024-10452Low· 2.2Grafana org admin can delete pending invites in different org
CVE-2019-19499Medium· 6.5Grafana Arbitrary File Read
CVE-2025-3415Medium· 4.3Grafana's insecure DingDing Alert integration exposes sensitive information
CVE-2020-12458Medium· 5.5Grafana information disclosure