Grafana Contact Point Privilege Escalation via Legacy Schema
CVE-2026-100105 Published on October 28, 2026
Alerting contact point authorization bypass via schema downgrade
A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).
Vulnerability Analysis
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-100105 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-100105
Want to know whenever a new CVE is published for Grafana Labs Grafana? stack.watch will email you.
Affected Versions
Grafana Enterprise:- Version 12.4.0, <= 12.4.13 is affected.
- Version 13.0.0, <= 13.0.11 is affected.
- Version 13.1.0, <= 13.1.8 is affected.
- Version 13.2.0, <= 13.2.4 is affected.
- Version 12.4.0, <= 12.4.13 is affected.
- Version 13.0.0, <= 13.0.11 is affected.
- Version 13.1.0, <= 13.1.8 is affected.
- Version 13.2.0, <= 13.2.4 is affected.