Grafana OSS Authorization Bypass Vulnerability in Provisioning Contact Points API

An authorization bypass vulnerability has been identified in Grafana OSS. This issue allows users with the Editor role to modify protected webhook URLs through the provisioning contact points API, without having the necessary alert.notifications.receivers.protected:write permission. The vulnerability arises from inadequate authorization checks, enabling unauthorized changes to be made to sensitive webhook configurations.

Impact

Exploitation of this vulnerability could lead to unauthorized modifications of protected webhook URLs, potentially disrupting notification workflows or causing unintended actions to be triggered by the webhooks.

Remediation

Users can upgrade to Grafana versions 12.3.1 prior to 12.3.6, 12.2.2 prior to 12.2.8, 12.1.5 prior to 12.1.10, or 11.6.9 prior to 11.6.14 to address this vulnerability.