Skip to main content

Graylog CVE-2025-53106

HIGH
Improper Authorization (CWE-285)
2025-07-02 security-advisories@github.com GHSA-3m86-c9x3-vwm9
Authentication Bypass Debian Graylog
8.8
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Generated
Mar 16, 2026 - 01:55 vuln.today
Patch released
Mar 16, 2026 - 01:55 nvd
Patch available
CVE Published
Jul 02, 2025 - 14:15 nvd
HIGH 8.8

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 2 maven packages depend on org.graylog2:graylog2-server (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 6.2.0.

DescriptionGitHub Advisory

Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user knows the ID. For the attack to succeed, the attacker needs a user account in Graylog. They can then proceed to issue hand-crafted requests to the Graylog REST API and exploit a weak permission check for token creation. This issue has been patched in versions 6.2.4 and 6.3.0-rc.2. A workaround involves disabling the respective configuration found in System > Configuration > Users > "Allow users to create personal access tokens".

Analysis

Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user knows the ID. For the attack to succeed, the attacker needs a user account in Graylog. They can then proceed to issue hand-crafted requests to the Graylog REST API and exploit a weak permission check for token creation. This issue has been patched in versions 6.2.4 and 6.3.0-rc.2. A workaround involves disabling the respective configuration found in System > Configuration > Users > "Allow users to create personal access tokens".

Technical ContextAI

This vulnerability is classified as Improper Authorization (CWE-285).

RemediationAI

A vendor patch is available. Apply it as soon as possible and verify the fix.

More in Graylog

View all
CVE-2024-24824 HIGH POC
8.8 Feb 07

Graylog is a free and open log management platform. Rated high severity (CVSS 8.8), this vulnerability is remotely explo
CVE-2024-52506 HIGH POC
7.1 Nov 18

Graylog is a free and open log management platform. Rated high severity (CVSS 7.1), this vulnerability is remotely explo
CVE-2026-1435 CRITICAL
9.8 Feb 18

Improper session invalidation in Graylog Web Interface 2.2.3 allows attackers to maintain access through expired session
CVE-2021-37760 CRITICAL
9.8 Jul 31

A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level

CVE-2021-37759 CRITICAL
9.8 Jul 31

A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access l
CVE-2023-41045 MEDIUM POC
5.3 Aug 31

Graylog is a free and open log management platform. Rated medium severity (CVSS 5.3), this vulnerability is remotely exp
CVE-2020-15813 HIGH
8.1 Jul 17

Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. Rated high severity (CVSS 8.1), this vulnerabili
CVE-2025-46827 HIGH
8.0 May 07

Graylog is a free and open log management platform. Rated high severity (CVSS 8.0), this vulnerability is remotely explo
CVE-2023-41044 LOW POC
3.8 Aug 31

Graylog is a free and open log management platform. Rated low severity (CVSS 3.8), this vulnerability is remotely exploi
CVE-2023-41041 LOW POC
3.1 Aug 30

Graylog is a free and open log management platform. Rated low severity (CVSS 3.1), this vulnerability is remotely exploi
CVE-2025-30373 MEDIUM
6.5 Apr 07

Graylog is a free and open log management platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
CVE-2026-1436 MEDIUM
6.5 Feb 18

Graylog 2.2.3 contains an insecure direct object reference (IDOR) vulnerability in its user API endpoint that allows aut

Same weakness CWE-285 – Improper Authorization

View all
CVE-2025-29927 CRITICAL POC
9.1
CVE-2016-5676 HIGH POC
7.5
CVE-2025-66301 CRITICAL POC
9.6
CVE-2023-32707 HIGH POC
8.8
CVE-2016-3352 HIGH
8.8
CVE-2025-29659 CRITICAL POC
9.8
CVE-2022-2595 CRITICAL POC
10.0
CVE-2026-55166 CRITICAL POC
9.9

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

Debian

Bug #652273
graylog2
Release Status Fixed Version Urgency
open - -

Share

CVE-2025-53106 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy