PT-2026-28321 · Grafana+1 · Grafana Oss+2

CVE-2026-21724

·

Publicado

2026-03-26

·

Atualizado

2026-07-30

CVSS v3.1

5.4

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Grafana OSS (affected versions not specified)
Description An authorization bypass exists in the provisioning contact points API. This allows users with the Editor role to modify protected webhook URLs without the necessary alert.notifications.receivers.protected:write permission. The affected API endpoint is used for provisioning contact points.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

BDU:2026-07792
BIT-GRAFANA-2026-21724
CVE-2026-21724
GHSA-7G92-G4VH-HP84
GO-2026-5219
OPENSUSE-SU-2026:10601-1
OPENSUSE-SU-2026:20940-1
OPENSUSE-SU-2026:21483-1
SUSE-SU-2026:1524-1
SUSE-SU-2026:2243-1
SUSE-SU-2026:2258-1
SUSE-SU-2026:2265-1

Produtos afetados

Grafana
Grafana Oss
Red Os