CVE-2026-72585

Grafana versions prior to 13.2.0 are vulnerable to an authorization bypass that allows Editor-role users to delete protected contact points without the necessary permissions. This flaw can lead to unauthorized modifications of alert notification configurations, potentially disrupting alerting mechanisms. Organizations using Grafana, particularly those relying on alert notifications, should prioritize applying the necessary updates to mitigate this risk.