CVE-2026-72585
|
| |
|
|
Affected software |
GRAFANA |
|
|
|
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points (receivers) without the required alert.notifications.receivers.protected:write permission. The fix for CVE-2026-21724 addressed only the UPDATE code path in both pkg/services/ngalert/provisioning/contactpoints.go and pkg/services/ngalert/notifier/receiver_svc.go, but the DELETE path in both receiver services was not updated with the protected-field check, leaving deletion operations unguarded. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-72585 |
