CVE-2026-100105: Alerting contact point authorization bypass via schema downgrade
A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Grafana deployments are exposed where users can edit alerting contact points but are not authorized to modify protected contact-point fields. Those users may be able to alter protected settings by changing an integration to a legacy schema version.
What access does an attacker need?
An attacker needs permission to edit contact points. No user interaction is required according to the provided vector.
What could an attacker change or access?
They may change protected settings, including a contact point destination URL. This can redirect alert notifications and may expose stored credentials.