Authorization Bypass in Grafana Affects User Permissions
CVE-2026-72585

6.5MEDIUM

Key Information:

Vendor

Grafana Labs

Status
Grafana
Vendor
CVE Published:
10 August 2026

What is CVE-2026-72585?

An authorization bypass vulnerability in Grafana enables an Editor-role user to delete protected contact points without possessing the necessary permissions for alert notifications. This flaw compromises the integrity of alert systems by allowing unprivileged users to alter critical configuration settings.

Affected Version(s)

Grafana 0 <= 13.2.0

References

https://grafana.com/security/security-advisories/cve-2026...
vendor-advisory
https://github.com/grafana/grafana
third-party-advisory
https://github.com/grafana/grafana/blob/main/pkg/services...
technical-description

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eldor Nabijonov
.