CVE-2026-21724 Missing Protected-field Authorization in Provisioning Contact Points API

What is CVE-2026-21724?

CVE-2026-21724 is a medium-severity missing authorization vulnerability in Grafana Grafana, published on 26 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.

Weakness: CWE-285

Which versions are affected by CVE-2026-21724?

4 open source packages ship an affected version, including github.com/grafana/grafana and grafana. It affects 1 product.

Products include Grafana Grafana.

How do I fix CVE-2026-21724?

Upgrade github.com/grafana/grafana to 1.9.2-0.20260323180334-daffe750de85 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-21724 being exploited?

There is no known exploitation of CVE-2026-21724 in the wild and no public exploit code.

Other vulnerabilities in Grafana Grafana

• CVE-2021-43798 Grafana Path Traversal Exploited High 7.5
• CVE-2025-41115 Incorrect privilege assignment Critical 10.0
• CVE-2022-39328 Grafana vulnerable to race condition allowing privilege escalation Critical 9.8
• CVE-2022-28660 Auth bypass in n/a Critical 9.8
• CVE-2022-26148 Information disclosure in n/a Critical 9.8

All Grafana Grafana vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-grafana-2026-21724, GHSA-7g92-g4vh-hp84, GO-2026-5219, MINI-2v58-35xh-63m5, MINI-3h3q-m2p8-874q, MINI-3m8r-c538-g455 and 6 more.