Users granted edit rights to a Grafana contact point can change the destination of that alerting webhook, even if they did not create it. By using the test functionality, an attacker can trigger the webhook and capture redacted secure settings, such as third‑party service tokens. The result is that compromised or new credentials are exposed, allowing the attacker to access and potentially control external services like Slack or other integrations.

The vulnerability affects Grafana’s Alerting component. Any instance where the Contact Point Writer role – part of the basic Editor role – is assigned to a user can be exploited. Because the issue is tied to permissions rather than a specific version, all Grafana installations using the default roles are potentially impacted until the patch is applied.

The CVSS score of 1.3 categorizes the flaw as low severity. No EPSS score is reported and the vulnerability is not listed in CISA’s KEV catalog, implying a low likelihood of widespread exploitation at present. However, the attack vector is likely internal and requires legitimate edit permissions. Once an attacker gains the ability to alter contact points and trigger tests, they can exfiltrate confidential tokens, leading to unauthorized access to third‑party services.