GHSA-j769-9gv9-65gr CVE-2026-55867
Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.56%
- Chance of exploitation in the next 30 days. Higher than 46.93% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-639 Authorization Bypass Through User-Controlled Key
- Fix
6.3.12- Upgrade org.graylog2:graylog2-server to this version or later
Description
Impact
Graylog contains an insecure direct object reference (IDOR) vulnerability in the token revocation endpoint. An authenticated user can delete access tokens belonging to other users, including service account tokens and administrator tokens, if they know or can guess a valid token identifier.
The issue does not expose token contents, but it allows unauthorized token deletion, leading to integrity impact and potential availability impact for access token based integrations.
Patches
The issue has been fixed in the following Graylog versions: 6.3.12, 7.0.7, 7.1.2. Users should upgrade to one of these versions or above to remediate the vulnerability.
Graylog Cloud has already been patched.
Workarounds
There are no feasible workarounds for this issue. Upgrading to a patched version is recommended.
Customers using Graylog Enterprise or Security can review the audit log^1 for suspicious activity. Audit log lines for successful token deletions begin with access token deleted from user.
Credits
Thanks to michaelddickenson and sreelim for reporting.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.graylog2:graylog2-server | >= 6.2.0, < 6.3.12 |
6.3.12 |
| org.graylog2:graylog2-server | >= 7.0.0, < 7.0.7 |
7.0.7 |
| org.graylog2:graylog2-server | >= 7.1.0, < 7.1.2 |
7.1.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.graylog2:graylog2-server Maven → 6.3.12
- maven
<dependency><groupId>org.graylog2</groupId><artifactId>graylog2-server</artifactId><version>6.3.12</version></dependency>- gradle
implementation("org.graylog2:graylog2-server:6.3.12")
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- Low
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-639: Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
How to prevent it
- Architecture and Design: For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
- Architecture and Design, Implementation: Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
- Architecture and Design: Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
References
Packages
Other links
- github.com/Graylog2/graylog2-server/security/advisories/GHSA-j769-9gv9-65gr
- github.com/Graylog2/graylog2-server/pull/26049
- github.com/Graylog2/graylog2-server/pull/26051
- github.com/Graylog2/graylog2-server/pull/26053
- github.com/Graylog2/graylog2-server/pull/26055
- github.com/Graylog2/graylog2-server/commit/41d3745d0e52736d06c07d279ca0d72c1616…
- github.com/Graylog2/graylog2-server/commit/4f280138b53dc3bbb5749213e8cb1c8e372f…
- github.com/Graylog2/graylog2-server/commit/84b0ffa0bdf918f6edd2bb23a47254088634…
- github.com/Graylog2/graylog2-server/commit/e5accc5f4ce48bd61b84bb8e5a13d21f8eac…
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-m9c2-85gv-8xr5 Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards | Medium | Also affects org.graylog2:graylog2-server |
| GHSA-gqr6-r77p-c2pj Fortigate syslog message parser can be exploited to modify or delete fields from the original message | High | Also affects org.graylog2:graylog2-server |
| GHSA-q79r-r9xg-r863 Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields | Medium | Also affects org.graylog2:graylog2-server |
| GHSA-3m86-c9x3-vwm9 Graylog vulnerable to privilege escalation through API tokens | High | Also affects org.graylog2:graylog2-server |
| GHSA-76vf-mpmx-777j Graylog Allows Session Takeover via Insufficient HTML Sanitization | Medium | Also affects org.graylog2:graylog2-server |
| GHSA-q9q2-3ppx-mwqf Graylog Allows Stored Cross-Site Scripting via Files Plugin and API Browser | High | Also affects org.graylog2:graylog2-server |
| GHSA-q7g5-jq6p-6wvx Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value | Medium | Also affects org.graylog2:graylog2-server |
| GHSA-p6gg-5hf4-4rgj Graylog vulnerable to instantiation of arbitrary classes triggered by API request | High | Also affects org.graylog2:graylog2-server |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor