Grafana OSS is vulnerable to an authorization bypass in its provisioning contact points API. Users with an Editor role can change protected webhook URLs without having the required alert.notifications.receivers.protected:write permission. This flaw effectively allows an authenticated user to modify data that should be restricted, enabling manipulation of alert destinations. The weakness is classified as CWE-266 (Least Privilege) and CWE-285 (Improper Authorization).

Any Grafana OSS installation that exposes the provisioning contact points API is potentially affected. No specific version information is provided, so all installations are considered at risk until a fix is applied.

The CVSS score is 5.4, indicating moderate severity, and the EPSS score is below 1%, suggesting a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated account with Editor permissions; an attacker can send API requests to modify webhook URLs. Because the attack requires legitimate account credentials, the risk is contained to systems where Editor privileges exist, but the impact of redirecting alerts could facilitate further attacks or data exfiltration.