Bug 2513106 (CVE-2026-72585) - CVE-2026-72585 grafana: Grafana: Authorization bypass allows Editor to delete protected contact points
Summary: CVE-2026-72585 grafana: Grafana: Authorization bypass allows Editor to delete...
Keywords:
Status: NEW
Alias: CVE-2026-72585
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-10 11:03 UTC by OSIDB Bzimport
Modified: 2026-08-14 16:28 UTC (History)
16 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-10 11:03:30 UTC 
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points (receivers) without the required alert.notifications.receivers.protected:write permission. The fix for CVE-2026-21724 addressed only the UPDATE code path in both pkg/services/ngalert/provisioning/contactpoints.go and pkg/services/ngalert/notifier/receiver_svc.go, but the DELETE path in both receiver services was not updated with the protected-field check, leaving deletion operations unguarded.
Note You need to log in before you can comment on or make changes to this bug.