CVE-2026-100105

Alerting contact point authorization bypass via schema downgrade

A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).

Affected

Grafana · Grafana Enterprise · Grafana OSS

CVSS v3.1 GRAFANA

7.7 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS

0.29% chance of exploitation in the next 30 days, 22nd percentile

Published

2026-10-28

Proof-of-concept exploits (1)

• googlesky/CVE-2026-100105Repo stars 0★ · pushed 2026-10-31 · find archive

CVE references

• https://grafana.com/security/security-advisories/cve-2026-100105VENDOR

References

• CVE Record
• NVD entry

Related

• CVE-2026-104623
• CVE-2026-110264
• CVE-2026-115560
• CVE-2026-116244
• CVE-2026-116366