Description

An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points (receivers) without the required alert.notifications.receivers.protected:write permission. The fix for CVE-2026-21724 addressed only the UPDATE code path in both pkg/services/ngalert/provisioning/contactpoints.go and pkg/services/ngalert/notifier/receiver_svc.go, but the DELETE path in both receiver services was not updated with the protected-field check, leaving deletion operations unguarded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-10T11:17:31.510Z",
  "pubdate": "2026-08-10T11:17:31.510Z",
  "executiveSummary": "An authorization bypass vulnerability exists in Grafana through version 13.2.0, allowing users assigned the Editor role to delete protected contact points (receivers) without possessing the required alert.notifications.receivers.protected:write permission.\nThis vulnerability impacts Grafana alerting systems by permitting unauthorized deletion of critical notification endpoints, disrupting incident response workflows and alerting mechanisms.\nThe risk implication is a loss of alert integrity and availability, as malicious or compromised Editor-level users can remove administrative-level alert receivers.\nAttacker capabilities are limited to authenticated users with the Editor role, who can leverage missing permission checks in the deletion logic to perform unauthorized destructive actions.\nExploitation requires valid user credentials with Editor-level privileges and access to the Grafana instance.",
  "technicalDetails": "The vulnerability stems from an incomplete patch implementation for CVE-2026-21724.\nWhile the previous fix successfully addressed the UPDATE code path within pkg/services/ngalert/provisioning/contactpoints.go and pkg/services/ngalert/notifier/receiver_svc.go, the corresponding DELETE path in both receiver services failed to incorporate the necessary protected-field validation check.\nConsequently, deletion operations remain unguarded against permission boundaries that restrict protected contact point manipulation.\nExploitation occurs when an authenticated user with the Editor role initiates an API request to delete a protected contact point.\nBecause the server-side validation logic in the DELETE handler omits the check for the alert.notifications.receivers.protected:write permission, the request is processed successfully.\nThe vulnerable components include the provisioning and notifier receiver services located in pkg/services/ngalert/provisioning/contactpoints.go and pkg/services/ngalert/notifier/receiver_svc.go.\nAffected versions include all Grafana deployments through 13.2.0.\nThe attack requires network exposure to the Grafana application interface, an authenticated session, and Editor-level privileges.\nPost-exploitation impact involves the unauthorized removal of critical notification receivers, potentially blinding monitoring systems and delaying incident response capabilities."
}