Security readout for executives and security teams
Plain-English summary
Authenticated Grafana OSS Editors may change webhook destinations that should require a stronger permission. This could redirect alert notifications or expose information sent through them. The issue does not permit unauthenticated access, and the supplied sources do not indicate service disruption or broader administrative control.
Executive priority
Treat as a scheduled, moderately urgent remediation. Prioritize internet-accessible or shared Grafana instances, environments with numerous Editors, and alerting workflows carrying sensitive data. Escalate if review finds unexpected webhook changes or untrusted Editor access.
Technical view
The provisioning contact points API fails to enforce the protected-field write authorization for webhook URLs. An Editor can therefore modify that protected field without alert.notifications.receivers.protected:write. The issue is classified as CWE-285 and CVSS 3.1 score 5.4, reflecting network reachability, low complexity, required privileges, and limited confidentiality and integrity impact.
Likely exposure
Exposure is limited to Grafana OSS deployments running the listed affected releases—12.3.1, 12.2.2, 12.1.5, or 11.6.9—where Editor accounts can reach the provisioning API and protected webhook contact points are used. Other versions are marked unaffected in the supplied record.
Exploitation context
The flaw requires an authenticated user with the Editor role and no user interaction. The supplied record is not in CISA KEV and provides no evidence of active exploitation or a public exploit. Abuse could alter protected webhook destinations, affecting alert confidentiality and integrity.
Researcher notes
The authorization gap concerns field-level enforcement rather than general endpoint authentication. Assessment should focus on the provisioning contact points API, Editor-role authorization, protected webhook fields, and enforcement of alert.notifications.receivers.protected:write. The supplied evidence does not identify affected commercial editions, root cause details, exploit availability, or a specific fixed version.
Mitigation direction
- Review Grafana's advisory for the vendor-approved remediation or fixed release.
- Upgrade affected Grafana OSS installations according to current vendor guidance.
- Temporarily limit Editor access to trusted users until remediation is confirmed.
- Monitor provisioning contact-point changes, particularly protected webhook URLs.
Validation and detection
- Inventory Grafana OSS versions and identify the four listed affected releases.
- Identify Editor accounts able to access provisioning contact-point functionality.
- Review audit or configuration history for unexpected webhook URL changes.
- After remediation, verify Editors cannot modify protected URLs without the required permission.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-285: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-21724 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N2.82.5GRAFANAVulnerability scoring details
Base CVSS 3.1 score
5.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://grafana.com/security/security-advisories/cve-2026-21724CVE reference, GRAFANA · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authorization
Improper Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.