An authorization bypass flaw in Grafana allows users with the Editor role to remove protected contact points (alert receivers) without the required alert.notifications.receivers.protected:write permission. The flaw stems from missing protection on delete operations in both the provisioning and notifier services, enabling deletion of critical alerting configurations. The result is a loss of essential notification pathways, which can lead to missed alerts for critical incidents but does not provide direct remote code execution or data exfiltration.

All installations of Grafana from versions prior to or including 13.2.0 are affected. The vulnerability exists in the pkg/services/ngalert/provisioning/contactpoints.go and pkg/services/ngalert/notifier/receiver_svc.go modules. Upgrade to a release that includes the missing protected‑field check for delete path to remediate the issue.

The CVSS score of 6.5 indicates a moderate severity, and the vulnerability is not currently listed in the CISA KEV catalog. EPSS data is unavailable, so the exploitation likelihood is unknown but it can be exercised by any authenticated user with Editor privileges via the Grafana UI or API. Because no additional system privileges are required, the risk is limited to disruption of alerting functionality rather than broader compromise.