CVE-2026-72585

Description

An authorization bypass in Grafana allows Editor-role users to delete protected contact points because a previous security patch for updating them missed the deletion process.

Statement

This Moderate impact authorization bypass in Grafana allows an authenticated Editor-role user to delete protected contact points without the necessary permissions. This could disrupt alert notifications in Red Hat deployments where Grafana is configured with alert managers and Editor-role users have access to manage alert configurations.

Mitigation

To mitigate this issue grant the Editor role only to trusted users and restrict access to the Grafana UI/API to trusted networks. Audit contact-point / receiver deletions and treat protected notification endpoints as sensitive configuration.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score6.5N/A6.5
Attack VectorNetworkN/ANetwork
Attack ComplexityLowN/ALow
Privileges RequiredLowN/ALow
User InteractionNoneN/ANone
ScopeUnchangedN/AUnchanged
ConfidentialityNoneN/ANone
Integrity ImpactHighN/AHigh
Availability ImpactNoneN/ANone

Vector

Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Understanding the Weakness (CWE)

CWE-284

Other

Technical Impact: Varies by Context

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.