An authorization bypass vulnerability in Grafana through version 13.2.0 permits an Editor-role user to delete protected contact points (receivers) without possessing the alert.notifications.receivers.protected:write permission. The missing protection on delete operations allows removal of critical alerting configurations, resulting in the loss of essential notification pathways that could cause missed alerts for critical incidents. This flaw does not enable remote code execution or data exfiltration, but it does provide unauthorized deletion of protected contact points.

All installations of Grafana from versions prior to or including 13.2.0 are affected. The vulnerability exists in the pkg/services/ngalert/provisioning/contactpoints.go module. Upgrade to a release that includes the missing protected‑field check for delete path to remediate the issue.

The CVSS score of 6.5 indicates a moderate severity, and the vulnerability is not currently listed in the CISA KEV catalog. EPSS data is unavailable, so the exploitation likelihood is unknown but it can be exercised by any authenticated user with Editor privileges via the Grafana UI or API. Because no additional system privileges are required, the risk is limited to disruption of alerting functionality rather than broader compromise.