CVE-2026-21724

Go/github.com/grafana/grafana CVE-2026-21724: medium 5.4

Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions

Action: Upgrade github.com/grafana/grafana to 1.9.2-0.20260323180334-daffe750de85 or later.

go get github.com/grafana/grafana@v1.9.2-0.20260323180334-daffe750de85

Affected

Fixed versions

Sources

• osv: GHSA-7g92-g4vh-hp84
• https://nvd.nist.gov/vuln/detail/CVE-2026-21724
• https://github.com/grafana/grafana/commit/daffe750de85b0dbf79f206a35835cf66a83d6ca
• https://github.com/advisories/GHSA-7g92-g4vh-hp84
• https://github.com/grafana/grafana
• https://github.com/grafana/grafana/releases/tag/v12.3.6
• https://grafana.com/security/security-advisories/cve-2026-21724

CVE-2026-21724 · published 2026-03-26T21:31:27Z · modified 2026-09-10T03:50:59.974994795Z · JSON

Go/github.com/grafana/grafana CVE-2026-21724: unknown

Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions in github.com/grafana/grafana

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-5219
• https://github.com/advisories/GHSA-7g92-g4vh-hp84
• https://nvd.nist.gov/vuln/detail/CVE-2026-21724
• https://github.com/grafana/grafana/commit/daffe750de85b0dbf79f206a35835cf66a83d6ca
• https://github.com/grafana/grafana/releases/tag/v12.3.6
• https://grafana.com/security/security-advisories/cve-2026-21724

CVE-2026-21724 · published 2026-06-25T18:43:15Z · modified 2026-06-26T15:44:23.297744353Z · JSON