CVE-2026-21724

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21724", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-01-05T09:26:06.214Z", "datePublished": "2026-03-26T20:06:18.829Z", "dateUpdated": "2026-08-27T17:22:23.621Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-27T17:22:23.621Z"}, "datePublic": "2026-03-25T22:00:37.352Z", "title": "Missing Protected-field Authorization in Provisioning Contact Points API", "descriptions": [{"lang": "en", "value": "A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission."}], "affected": [{"vendor": "Grafana", "product": "Grafana OSS", "defaultStatus": "unaffected", "versions": [{"version": "12.3.1", "status": "affected", "versionType": "semver", "lessThan": "12.3.6"}, {"version": "12.2.2", "status": "affected", "versionType": "semver", "lessThan": "12.2.8"}, {"version": "12.1.5", "status": "affected", "versionType": "semver", "lessThan": "12.1.10"}, {"version": "11.6.9", "status": "affected", "versionType": "semver", "lessThan": "11.6.14"}]}], "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-21724", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}}], "source": {"discovery": "BUG_BOUNTY"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "CWE-285 Improper Authorization"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-27T13:42:43.732342Z", "id": "CVE-2026-21724", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T13:56:12.761Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21724", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-27T13:42:43.732342Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285 Improper Authorization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T13:42:53.364Z"}}], "cna": {"title": "Missing Protected-field Authorization in Provisioning Contact Points API", "source": {"discovery": "BUG_BOUNTY"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "12.3.1", "lessThan": "12.3.6", "versionType": "semver"}, {"status": "affected", "version": "12.2.2", "lessThan": "12.2.8", "versionType": "semver"}, {"status": "affected", "version": "12.1.5", "lessThan": "12.1.10", "versionType": "semver"}, {"status": "affected", "version": "11.6.9", "lessThan": "11.6.14", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-03-25T22:00:37.352Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-21724", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission."}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-08-26T08:50:05.420Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21724", "state": "PUBLISHED", "dateUpdated": "2026-08-26T08:50:05.420Z", "dateReserved": "2026-01-05T09:26:06.214Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-03-26T20:06:18.829Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThan": "12.3.6", "status": "affected", "version": "12.3.1", "versionType": "semver"}, {"lessThan": "12.2.8", "status": "affected", "version": "12.2.2", "versionType": "semver"}, {"lessThan": "12.1.10", "status": "affected", "version": "12.1.5", "versionType": "semver"}, {"lessThan": "11.6.14", "status": "affected", "version": "11.6.9", "versionType": "semver"}]}], "source": "security@grafana.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "B333C05C-D6CC-4292-B54B-5D081FE92C6E", "versionEndExcluding": "11.6.14", "versionStartIncluding": "11.6.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "252E74A8-BC0A-420D-A937-84AAE46C8BDA", "versionEndExcluding": "12.1.10", "versionStartIncluding": "12.1.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "409163A6-7B0A-4E46-AD47-620AFC841A9B", "versionEndExcluding": "12.2.8", "versionStartIncluding": "12.2.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:-:*:*:*", "matchCriteriaId": "875BA099-9D0F-4DC0-80DF-5F35D06097AC", "versionEndExcluding": "12.3.6", "versionStartIncluding": "12.3.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission."}, {"lang": "es", "value": "Se ha descubierto una vulnerabilidad en Grafana OSS donde una omisi\u00f3n de autorizaci\u00f3n en la API de puntos de contacto de aprovisionamiento permite a los usuarios con rol de Editor modificar URLs de webhook protegidas sin el permiso requerido alert.notifications.receivers.protected:write."}], "id": "CVE-2026-21724", "lastModified": "2026-06-17T13:20:05.397", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@grafana.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21724", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-27T13:42:43.732342Z", "version": "2.0.3"}}]}, "published": "2026-03-26T21:17:03.227", "references": [{"source": "security@grafana.com", "tags": ["Vendor Advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-21724"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "Grafana OSS: Grafana OSS: Authorization bypass allows modification of protected webhook URLs", "id": "2451938", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451938"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-266", "details": ["A flaw was found in Grafana OSS. An authorization bypass vulnerability in the provisioning contact points API allows users with an Editor role to modify protected webhook URLs. This can lead to unauthorized changes to notification configurations, potentially resulting in information disclosure or integrity issues."], "name": "CVE-2026-21724", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-26T20:06:18Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-21724\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-21724\nhttps://grafana.com/security/security-advisories/cve-2026-21724"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": ["onprem"], "status": "affected", "versions": {"scheme": "semver", "value": "[12.3.1,12.3.6)"}}, {"platform": ["onprem"], "status": "affected", "versions": {"scheme": "semver", "value": "[12.2.2,12.2.8)"}}, {"platform": ["onprem"], "status": "affected", "versions": {"scheme": "semver", "value": "[12.1.5,12.1.10)"}}, {"platform": ["onprem"], "status": "affected", "versions": {"scheme": "semver", "value": "[11.6.9,11.6.14)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "Grafana OSS", "source": "cna", "vendor": "Grafana"}, "product": "grafana", "vendor": "grafana"}], "analysis": {"en": {"generated_at": "2026-04-14T02:25:25.323213+00:00", "value": {"mitigation_remediation": ["Apply the latest Grafana OSS patch or upgrade to a version that fixes the authorization bypass.", "Revoke unnecessary Editor permissions or enforce least privilege for users who do not need to modify alerts.", "Ensure that only administrators can create or change protected webhook URLs by configuring role-based access controls.", "Monitor provisioning API activity for unexpected changes to webhook URLs and investigate promptly."], "summary": {"action": "Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Any Grafana OSS installation that exposes the provisioning contact points API is potentially affected. No specific version information is provided, so all installations are considered at risk until a fix is applied.", "description_and_impact": "Grafana OSS is vulnerable to an authorization bypass in its provisioning contact points API. Users with an Editor role can change protected webhook URLs without having the required alert.notifications.receivers.protected:write permission. This flaw effectively allows an authenticated user to modify data that should be restricted, enabling manipulation of alert destinations. The weakness is classified as CWE-266 (Least Privilege) and CWE-285 (Improper Authorization).", "risk_and_exploitability": "The CVSS score is 5.4, indicating moderate severity, and the EPSS score is below 1%, suggesting a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated account with Editor permissions; an attacker can send API requests to modify webhook URLs. Because the attack requires legitimate account credentials, the risk is contained to systems where Editor privileges exist, but the impact of redirecting alerts could facilitate further attacks or data exfiltration."}}}}, "created": "2026-03-27T08:32:10.008645+00:00", "updated": "2026-04-14T16:42:40.984583+00:00", "vendors": ["grafana", "grafana$PRODUCT$grafana"]}