Graylog CVE-2026-55867

The attacker must hold a valid authenticated Graylog session with any role, including minimal-privilege user accounts, satisfying the PR:L prerequisite in the CVSS vector. They must additionally know or be able to enumerate the idOrToken identifier of a token belonging to another user - token identifiers are not returned by the vulnerable endpoint itself, so discoverability through audit log review, other API responses, or enumeration of predictable identifier formats is a practical prerequisite. Exploitation is constrained to token deletion only; token secret values are never disclosed. The vulnerability affects only self-hosted Graylog instances running affected versions (6.2.0-6.3.11, 7.0.0-7.0.6, 7.1.0-7.1.1); Graylog Cloud is already patched and not exposed.

The CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L correctly reflects network accessibility and low attack complexity, bounded by the requirement for a valid authenticated session (PR:L) and the absence of confidentiality exposure. EPSS data was not provided in the input, and this CVE does not appear in CISA KEV, so no confirmed active exploitation is known at time of analysis. No proof-of-concept code has been referenced in any provided source. Despite the moderate score, operational risk is elevated for environments using service-account tokens or token-based API automation: a low-privileged insider or compromised account could selectively revoke administrator tokens or integration credentials, causing authentication failures in SIEM pipelines or forcing emergency re-credentialing. The vendor explicitly states no workaround exists, raising patch urgency. The primary limiting factor is the need to know or discover a target token's identifier, which is not directly exposed by this endpoint but may be accessible via audit logs or other API surfaces.

An authenticated Graylog user with minimal privileges issues a DELETE request to /users/{own-userId}/tokens/{admin-token-id}, supplying their own userId to satisfy the permission check while targeting the token identifier of an administrator or service account. Graylog resolves the token by the supplied identifier regardless of ownership, the permission guard passes against the attacker's own username, and the victim's token is deleted. The attacker does not need the token's secret value - only its identifier, which may be discoverable through Graylog audit logs or prior API interactions.