An authorization bypass in Grafana OSS allows a user with Editor role to change protected webhook URLs without the required alert.notifications.receivers.protected:write permission. The discrepancy between the assigned role and the permissions enforced leads to a moderate risk of an attacker redirecting alert notifications to malicious endpoints, potentially compromising confidentiality and availability of notification services.

The flaw exists in Grafana OSS. No specific version information has been supplied in the advisory, so all deployed instances of Grafana OSS that have not been patched may be vulnerable. The vulnerability is tied to the provisioning contact points API, which is accessed by authenticated users within the application.

The CVSS score of 5.4 indicates moderate severity; no EPSS score is provided and the issue is not listed in CISA’s KEV catalogue, suggesting limited known exploitation. Based on the description, the likely attack vector is an authenticated user possessing Editor permissions, which must also have network access to the Grafana API. The potential impact is that an attacker could silently modify webhook URLs, leading to unauthorized data exfiltration or service disruption.