PT-2026-28321 · Grafana+1 · Grafana Oss+2

Published 2026-03-26 · Updated 2026-05-24 · CVE-2026-21724

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Grafana OSS (affected versions not specified)

Description An authorization bypass exists in the provisioning contact points API. This allows users with the Editor role to modify protected webhook URLs without the necessary alert.notifications.receivers.protected:write permission. The affected API endpoint is used for provisioning contact points.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2026-07792

BIT-GRAFANA-2026-21724

CVE-2026-21724

GHSA-7G92-G4VH-HP84

OPENSUSE-SU-2026:10601-1

SUSE-SU-2026:1524-1

Affected Products

Grafana

Grafana Oss

Red Os

References · 67

• https://nvd.nist.gov/vuln/detail/CVE-2026-21724 · Security Note
• https://bdu.fstec.ru/vul/2026-07792 · Security Note
• https://osv.dev/vulnerability/GHSA-7g92-g4vh-hp84 · Vendor Advisory
• https://grafana.com/security/security-advisories/cve-2026-21724 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-21724 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-21724 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1524-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-21724 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10601-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-grafana-2026-21724 · Vendor Advisory
• https://github.com/grafana/grafana · Note
• https://github.com/grafana/grafana/releases/tag/v12.3.6 · Note
• https://github.com/grafana/grafana/commit/daffe750de85b0dbf79f206a35835cf66a83d6ca · Note
• https://bugzilla.suse.com/1257660 · Note
• https://bugzilla.suse.com/1260878 · Note