Is there a patch available for CVE-2026-65011?

Yes, a patch is available for CVE-2026-65011. Update the affected software to the latest version immediately.

Graylog2 Server CVE-2026-65011

Q: What is the CVSS score of CVE-2026-65011?

CVE-2026-65011 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-47743 MEDIUM

Missing Authorization (CWE-862)

2026-07-22 VulnCheck

GHSA-p2j9-4mg8-mm73

Authentication Bypass Graylog2 Server

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-accessible REST API requiring low-privilege authenticated session; no scope change, confidentiality-only impact limited to reading restricted event definition configurations.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 17:19 vuln.today

Analysis Generated

Jul 22, 2026 - 17:19 vuln.today

DescriptionCVE.org

Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/{definitionId}/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private event definitions including detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings by duplicating them.

AnalysisAI

Graylog2 Server's event definition duplicate endpoint fails per-entity authorization, allowing any authenticated low-privilege user holding only the global eventdefinitions:create capability to clone event definitions they have not been granted access to. By issuing POST /events/definitions/{definitionId}/duplicate against arbitrary IDs, an attacker receives a full copy of the target definition - exposing detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings that may be restricted to other teams or roles. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the upstream fix is confirmed at commit 46a2eeba4cdbc1408ff4cbf7b466853a8acfb38d.

Technical ContextAI

The flaw resides in EventDefinitionsResource.java (org.graylog.events.rest) within the Graylog2 REST API layer, affecting all versions covered by CPE cpe:2.3:a:graylog2:graylog2-server:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization): the duplicate() method enforced the global eventdefinitions:create capability check but omitted the per-entity EVENT_DEFINITIONS_READ check for the target definitionId. Graylog's RBAC model separates global capability grants (e.g., 'can create event definitions') from object-level grants (e.g., 'can read this specific definition'), and the duplicate endpoint bypassed the latter gate entirely. The fix - confirmed in PR #26706 - adds a single checkPermission(RestPermissions.EVENT_DEFINITIONS_READ, definitionId) call before any data is loaded or cloned, and accompanying tests verify that the database service is never invoked when the caller lacks read access to the target definition.

RemediationAI

Upstream fix available via commit 46a2eeba4cdbc1408ff4cbf7b466853a8acfb38d (PR https://github.com/Graylog2/graylog2-server/pull/26706); a tagged patched release version is not independently confirmed from available data - monitor the Graylog2 GitHub releases page and issue #26590 for the release incorporating this commit and upgrade to that version promptly. As an interim compensating control, restrict the eventdefinitions:create global capability to administrator-equivalent roles only, removing it from general low-privilege user roles; this eliminates the exploitable permission combination at the cost of preventing lower-privilege users from creating event definitions - an acceptable trade-off in most environments until patching is complete. Additionally, audit Graylog API access logs for anomalous calls to POST /events/definitions/*/duplicate by accounts not typically performing detection engineering work, which may indicate exploitation attempts. Reference the VulnCheck advisory at https://www.vulncheck.com/advisories/graylog2-server-missing-permission-check-on-event-definition-duplicate for further guidance.