Go/github.com/grafana/grafana CVE-2026-21724: medium 5.4, EPSS 0.27%
Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions
Action: Upgrade github.com/grafana/grafana to 1.9.2-0.20260323180334-daffe750de85 or later.
go get github.com/grafana/grafana@v1.9.2-0.20260323180334-daffe750de85Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.9.2-0.20260323180334-daffe750de85 | - |
Fixed versions
| 1.9.2-0.20260323180334-daffe750de85 |
Sources
- osv: GHSA-7g92-g4vh-hp84
- https://nvd.nist.gov/vuln/detail/CVE-2026-21724
- https://github.com/grafana/grafana/commit/daffe750de85b0dbf79f206a35835cf66a83d6ca
- https://github.com/advisories/GHSA-7g92-g4vh-hp84
- https://github.com/grafana/grafana
- https://github.com/grafana/grafana/releases/tag/v12.3.6
- https://grafana.com/security/security-advisories/cve-2026-21724
CVE-2026-21724 · published · modified · JSON