MEDIUM 6.5 NVD
CVE-2026-72585
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points (receivers) without the required a
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points (receivers) without the required alert.notifications.receivers.protected:write permission.
References
- https://github.com/grafana/grafana
- https://github.com/grafana/grafana/blob/main/pkg/services/ngalert/provisioning/contactpoin
- https://grafana.com/security/security-advisories/cve-2026-21724/
This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-08-10 via NVD.
vulnfeed aggregates 9095 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.