This vulnerability in Grafana OSS involves an authorization bypass in the provisioning contact points API. Specifically, users assigned the Editor role can modify protected webhook URLs without possessing the necessary permission alert.notifications.receivers.protected:write. The issue relates to improper enforcement of authorization checks, classified under CWE-285 (Improper Authorization). The CVSS 3.1 base score is 5.4, reflecting a network attack vector with low complexity, requiring low privileges and no user interaction, resulting in limited confidentiality and integrity impacts but no availability impact.

An attacker with Editor role privileges can alter protected webhook URLs, potentially redirecting alert notifications or interfering with alerting mechanisms. This could lead to limited confidentiality and integrity impacts, such as unauthorized modification of alert endpoints. There is no known exploitation in the wild, and the vulnerability does not affect availability.

No official patch or fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Editor role assignments to trusted users only and monitor changes to webhook configurations closely.