CVE-2026-72585

Published: Ago 10, 2026 Last Modified: Ago 10, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,5
Source: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: none

Description

AI Translation Available

An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points (receivers) without the required alert.notifications.receivers.protected:write permission.

284

Improper Access Control

Incomplete
Abstraction: Pillar Structure: Simple
Common Consequences
Security Scopes Affected:
Other
Potential Impacts:
Varies By Context
Applicable Platforms
Technologies: Not Technology-Specific, ICS/OT, Web Based
View CWE Details
https://github.com/grafana/grafana
https://github.com/grafana/grafana
https://github.com/grafana/grafana/blob/main/pkg/services/n…
https://github.com/grafana/grafana/blob/main/pkg/services/ngalert/provisioning/…
https://grafana.com/security/security-advisories/cve-2026-2…
https://grafana.com/security/security-advisories/cve-2026-21724/