CVE-2026-72585 in Grafana
Summary
by MITRE • 08/10/2026
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points (receivers) without the required alert.notifications.receivers.protected:write permission. The fix for CVE-2026-21724 addressed only the UPDATE code path in both pkg/services/ngalert/provisioning/contactpoints.go and pkg/services/ngalert/notifier/receiver_svc.go, but the DELETE path in both receiver services was not updated with the protected-field check, leaving deletion operations unguarded.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This authorization bypass vulnerability in Grafana versions prior to 13.2.0 represents a critical security weakness that undermines the platform's access control mechanisms for alerting configurations. The flaw specifically targets users assigned the Editor role who should not possess the ability to modify or remove protected contact points within the system. This issue stems from an incomplete implementation of access controls where the fix for CVE-2026-21724 only addressed the update operations but failed to extend protection to deletion functions, creating a significant gap in the security model. The vulnerability operates through a fundamental flaw in the permission checking logic that governs how users interact with protected alerting components.
The technical implementation of this vulnerability occurs within the notification receiver services where Grafana maintains separate code paths for different operations on contact points. While the update functionality correctly validates whether users possess the required alert.notifications.receivers.protected:write permission before allowing modifications, the delete operations completely bypass this validation check. This inconsistency creates a scenario where Editor-level users can remove critical contact point configurations without proper authorization, potentially disrupting alerting workflows and exposing sensitive notification endpoints to unauthorized removal. The vulnerability exists in both pkg/services/ngalert/provisioning/contactpoints.go and pkg/services/ngalert/notifier/receiver_svc.go files, indicating a systemic failure in the access control implementation across multiple service layers.
The operational impact of this vulnerability extends beyond simple privilege escalation as it allows malicious or unauthorized users to compromise the integrity of Grafana's alerting infrastructure. When an Editor user can delete protected contact points, they effectively gain the ability to disrupt critical monitoring workflows that depend on these configurations. This could result in alerting gaps during security incidents, potential data loss from compromised notification chains, and overall degradation of system monitoring capabilities. The vulnerability particularly affects organizations that rely heavily on Grafana for operational monitoring and incident response, as it provides a means for unauthorized users to undermine the alerting infrastructure that is crucial for maintaining system security and availability.
Organizations should implement immediate mitigations including updating to Grafana version 13.2.0 or later where the fix has been properly implemented, ensuring that all access control checks are consistently applied across both update and delete operations. Additional defensive measures include reviewing existing user permissions and roles to ensure proper least-privilege principles are enforced, implementing network-level restrictions on alerting service endpoints, and monitoring for unauthorized deletion activities in Grafana's audit logs. Security teams should also consider implementing additional controls such as configuration management systems that can detect and prevent unauthorized changes to critical alerting configurations. This vulnerability aligns with CWE-284 (Improper Access Control) and represents a specific implementation of insufficient privilege checking that enables unauthorized actions through the deletion pathway, potentially mapping to ATT&CK techniques related to privilege escalation and persistence within monitoring infrastructure.
The root cause of this issue demonstrates a common pattern in software development where security fixes are implemented incompletely, focusing only on one aspect of a broader functionality while leaving other related operations unprotected. This partial fix approach creates dangerous blind spots in the security model and highlights the importance of comprehensive testing and review processes for access control implementations. Organizations should establish rigorous code review practices that ensure all code paths within security-critical functions are consistently validated against required permissions, particularly when addressing vulnerabilities that affect multiple operational modes such as create, read, update, and delete operations. The vulnerability serves as a reminder that authorization controls must be implemented systematically across all possible interaction points within a system's API surface to prevent exploitation through any available attack vector.