This vulnerability in Grafana OSS involves an authorization bypass in the provisioning contact points API. Specifically, users assigned the Editor role can modify protected webhook URLs without possessing the necessary alert.notifications.receivers.protected:write permission. The issue affects several versions of Grafana OSS, including 11.6.9, 12.1.5, 12.2.2, and 12.3.1. The CVSS 3.1 base score is 5.4, indicating a medium severity level. There are no known exploits in the wild, and no official patch or remediation details have been provided in the available data.

An attacker with Editor role privileges can modify protected webhook URLs without proper authorization, potentially leading to unauthorized changes in alert notification configurations. The impact is limited to confidentiality and integrity with no direct availability impact. This could allow unauthorized modification of alerting mechanisms, which might affect monitoring reliability or cause information disclosure through altered webhook endpoints.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Editor role assignments to trusted users only and monitor changes to webhook configurations closely. Follow Grafana's official advisories for updates on patches or workarounds.