This vulnerability in Grafana Alerting (version 8.0.0) allows users with specific edit permissions (alert.notifications:write or alert.notifications.receivers:test) granted by the Contact Point Writer role to edit contact points created by other users. By changing the endpoint URL to a controlled server and invoking the test function, these users can capture redacted secure settings, including authentication credentials for third-party integrations such as Slack tokens. This results in unauthorized disclosure of sensitive information. The CVSS 4.0 base score is 1.3, reflecting low severity due to required privileges and limited impact. No vendor advisory or patch is currently available, and no known exploits have been reported.

The vulnerability allows unauthorized disclosure of sensitive authentication credentials for third-party services integrated with Grafana Alerting. This could lead to unauthorized access or compromise of those external services. However, exploitation requires edit permissions on contact points, limiting the attacker scope. The low CVSS score indicates limited impact and low likelihood of widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict edit permissions on contact points to trusted users only to minimize risk. Monitor for updates from Grafana regarding patches or configuration changes that address this issue.