EUVD-2026-84038
GHSA-m9c2-85gv-8xr5
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Impact | This is a moderate, real-but-bounded access-control flaw, not an urgent priority. The CVSS 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) correctly reflects a low-friction network attack that nonetheless requires an authenticated account holding edit permission on a shared entity - so it is post-authentication and cannot be triggered by anonymous internet traffic. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the signals are internally consistent (moderate severity, contained impact, no exploitation indicators). The all-Low C/I/A triad is appropriate because damage is confined to individual saved searches or dashboards rather than the whole platform. Notably, the CWE-639 (broken object-level authorization / IDOR-family) root cause is at odds with the input Tag 'Authentication Bypass' - this is an authorization/ownership-enforcement bug affecting an already-authenticated user, not an authentication bypass; verify tag semantics before triage routing. Overall this is a legitimate multi-tenant integrity issue for shared Graylog deployments but does not warrant emergency patching absent exploitation signals. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Graylog's saved-search and dashboard update API allows an authenticated user who holds edit permission on a view - but not ownership of it - to escalate to owner by attaching a crafted shareRequest to the update call, then use that ownership to delete the view or revoke the legitimate owner's access. Affected releases are Graylog 6.3.0 through 6.3.13, 7.0.0 through 7.0.8, and 7.1.0 through 7.1.3; Graylog Cloud customers were patched before the advisory was published. The flaw is rated CVSS 3.1 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), meaning it requires a low-privileged authenticated session, needs no user interaction, and is bounded to low confidentiality, integrity, and availability impact; no public exploit code identified at time of analysis and no confirmed active exploitation.
RemediationAI
Vendor-released patch: upgrade to Graylog 6.3.14, 7.0.9, or 7.1.4 as appropriate for your deployment line - these releases contain the ownership validation added in PR 26344 (https://github.com/Graylog2/graylog2-server/pull/26344), which reparents ViewsResource under RestResourceWithOwnerCheck and forces a checkOwnership() call on the view GRN before any share request is applied; see the advisory at https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-m9c2-85gv-8xr5. If immediate upgrade is not possible, reduce the population of users holding edit grants on shared searches and dashboards, since the flaw requires edit permission without ownership - auditing and trimming those grants removes the prerequisite entirely, though it also removes legitimate collaborative editing. Administrators should additionally review current entity share lists for unexpected owner entries and unexpected deletions of saved searches or dashboards, and revoke any owner grants that cannot be attributed to a known change; restricting network access to the Graylog web/API endpoints to trusted networks limits exposure but degrades normal user access. Note that the affected branches are patch-only - no configuration flag disables the shareRequest handling in the update endpoint, so restricting share-management permissions or upgrading are the only effective controls. Monitor the referenced fix commits (9303f395dd29c03abd8885f1c7d1c90f8aae72d4, ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2, c87879642537d07760a572ba01b76cb657582608, e98c6670d05748a9749ab0646be7f40561734b42) for backport status on any extended-support builds you run.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is an instance of CWE-639 (Authorization Bypass Through User-Controlled Key) in the ViewsResource REST controller of graylog2-server, which backs the saved-search and dashboard ("view") feature of the Graylog search plugin. Each view is addressed by a GRN (Graylog Resource Name) whose type is either GRNTypes.DASHBOARD or GRNTypes.SEARCH, and the update endpoint accepted a CreateEntityRequest carrying an optional shareRequest (EntityShareRequest). Internally, entitySharesService.updateEntityShares() applied the submitted share entries after only the coarse-grained edit permission had been verified, because ViewsResource extended the plain RestResource base class rather than the ownership-enforcing RestResourceWithOwnerCheck. The authorization check therefore keyed off an attacker-influenced identifier (the view id in the request) against a permission that edit-level grantees already hold, letting the caller write an owner grant for an arbitrary account into the share list. The upstream fix (PR 26344, commits 9303f395, a1c0b19e, c8787964, e98c6670) reparents ViewsResource to RestResourceWithOwnerCheck and adds an explicit checkOwnership(grnType.toGRN(dto.id())) call before the share request is processed; the accompanying test throwsExceptionWhenUpdatingSharingOfViewUserDoesNotOwn confirms a ForbiddenException is now raised and the view service update is never invoked.
Know when Graylog2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Log-record tampering in Graylog's FortiGate syslog parser enables unauthenticated network senders to overwrite or erase
Unauthorized token deletion in Graylog's REST API (versions 6.2.0 through 6.3.11, 7.0.0-7.0.6, and 7.1.0-7.1.1) allows a
Graylog2 before 0.92 allows remote attackers to bypass LDAP authentication via crafted wildcards. Rated medium severity
Server-side request forgery (SSRF) in Graylog through version 7.1.4 allows an authenticated user who holds lookup table
Graylog2 Server's event definition duplicate endpoint fails per-entity authorization, allowing any authenticated low-pri
Exploit-DB