What is GHSA-7g92-g4vh-hp84?

GHSA-7g92-g4vh-hp84 is a security advisory published by GitHub Security Advisories with Medium severity. Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions

Which CVE IDs does GHSA-7g92-g4vh-hp84 cover?

GHSA-7g92-g4vh-hp84 covers the following CVE IDs: CVE-2026-21724. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7g92-g4vh-hp84?

GHSA-7g92-g4vh-hp84 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-7g92-g4vh-hp84?

GHSA-7g92-g4vh-hp84 affects 1 product, including: go/github.com/grafana/grafana:\u003c 1.9.2-0.20260323180334-daffe750de85.

GHSA-7g92-g4vh-hp84MediumCVSS 5.4

Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions

Vendor

GitHub Security Advisories

Published

March 26, 2026

Last Modified

July 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-21724 →

📋 Description

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.

A patched version is available at https://github.com/grafana/grafana/releases/tag/v12.3.6.

🎯 Affected products1

go/github.com/grafana/grafana:< 1.9.2-0.20260323180334-daffe750de85

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-21724
https://grafana.com/security/security-advisories/cve-2026-21724
https://github.com/grafana/grafana/commit/daffe750de85b0dbf79f206a35835cf66a83d6ca
https://github.com/grafana/grafana/releases/tag/v12.3.6
https://github.com/advisories/GHSA-7g92-g4vh-hp84