Alerting contact point authorization bypass via schema downgrade
// AI summary
Grafana allows an authorization bypass via schema downgrade, enabling users who can edit contact points to change protected settings like destination URLs, potentially exposing credentials.
// from the source
A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point s destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).