CVE-2026-72585: Grafana - Incomplete Fix for CVE-2026-21724 Allows Editor Role to Delete Protected Contact Points
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points (receivers) without the required alert.notifications.receivers.protected:write permission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure Editor-role users attempting DELETE of protected contact points (receivers) are required to have the alert.notifications.receivers.protected:write permission; the DELETE path in receiver services must enforce the protected-field check (not just the UPDATE code path in pkg/services/ngalert/provisioning/contactpoints.go and pkg/services/ngalert/notifier/receiver_svc.go).
Grafana ngalert protected contact points (receivers) authorization alert.notifications.receivers.protected:write permission = required for delete operations
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72585?
CVE-2026-72585 has a medium severity rating of 6.5.
How do I fix CVE-2026-72585?
To fix CVE-2026-72585, update your Grafana instance to include the relevant patches that address the authorization bypass.
What are the implications of CVE-2026-72585?
CVE-2026-72585 allows an unauthorized Editor-role user to delete protected contact points in Grafana.
Which versions of Grafana are affected by CVE-2026-72585?
CVE-2026-72585 affects Grafana versions prior to the fixed version released after the vulnerability was disclosed.
What does CVE-2026-72585 allow attackers to do?
CVE-2026-72585 allows attackers with the Editor role to delete contact points without necessary permissions, posing a risk to system integrity.