This vulnerability in Grafana 13.2.0 involves improper access control (CWE-284) where an Editor-role user can bypass authorization checks to delete protected contact points (receivers) without the alert.notifications.receivers.protected:write permission. The prior fix for CVE-2026-21724 only secured the update code paths in the relevant receiver service files but failed to apply the same protection to the delete code paths, leaving deletion operations unguarded and vulnerable to unauthorized actions.

An attacker with Editor role privileges can delete protected alert notification receivers without proper authorization, potentially disrupting alerting mechanisms. The vulnerability does not affect confidentiality or availability but impacts integrity by allowing unauthorized modification of alert configurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Editor role permissions carefully and monitor for unauthorized deletion of contact points. Avoid granting Editor role to untrusted users.