This vulnerability in Grafana OSS (CVE-2026-21724) allows users assigned the Editor role to bypass authorization controls in the provisioning contact points API. Specifically, these users can modify protected webhook URLs without possessing the necessary alert.notifications.receivers.protected:write permission. The issue affects multiple recent versions of Grafana OSS (11.6.9, 12.1.5, 12.2.2, and 12.3.1). The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. The weakness is categorized under CWE-285 (Improper Authorization). No patch links or vendor advisories are currently available, and no known exploits have been reported.

The vulnerability allows an Editor role user to modify protected webhook URLs without proper authorization, potentially leading to unauthorized changes in alert notification configurations. This could affect the confidentiality and integrity of alert notifications by redirecting or altering webhook endpoints. There is no indication of impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Editor role assignments to trusted users only and monitor for unauthorized changes to webhook configurations. Avoid granting unnecessary permissions related to alert.notifications.receivers.protected:write. Follow Grafana's official channels for updates on patches or workarounds.