Incorrect Authorization in Grafana Affects Integration Settings
CVE-2026-100105

7.7HIGH

Key Information:

Vendor

Grafana
Status
Grafana Enterprise
Grafana Oss
Vendor
CVE Published:
28 October 2026

What is CVE-2026-100105?

A significant vulnerability exists in Grafana where users with editing permissions can exploit an integration's legacy schema version to alter protected settings. This can lead to unintended modifications of essential contact point configurations, including destination URLs. Consequently, this exposure may allow unauthorized access to stored credentials and misdirect alert notifications to malicious endpoints, fundamentally compromising system security.

Affected Version(s)

Grafana Enterprise 12.4.0 <= 12.4.13

Grafana Enterprise 13.0.0 <= 13.0.11

Grafana Enterprise 13.1.0 <= 13.1.8

References

https://grafana.com/security/security-advisories/cve-2026...
vendor-advisory

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.