Graylog2 Server
Monthly
Unauthorized token deletion in Graylog's REST API (versions 6.2.0 through 6.3.11, 7.0.0-7.0.6, and 7.1.0-7.1.1) allows any authenticated user to revoke access tokens belonging to other accounts - including administrators and service accounts - by exploiting a misplaced permission check in the token revocation endpoint. The flaw does not expose token secret values but can invalidate privileged credentials and disrupt automated integrations that rely on access tokens. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available in versions 6.3.12, 7.0.7, and 7.1.2.
Log-record tampering in Graylog's FortiGate syslog parser enables unauthenticated network senders to overwrite or erase critical security-log fields - including srcip, dstip, date, time, and tz - or cause entire log messages to be silently discarded, creating a viable log-evasion primitive. Affected are Graylog Server versions prior to 6.3.12, 7.0.7, and 7.1.2 (all branches), and Graylog Forwarder prior to version 7.3, on any deployment ingesting FortiGate key-value syslog. No public exploit code exists and this is not in CISA KEV, but the attack requires no authentication and minimal crafting skill, making it a realistic threat to security-monitoring integrity in FortiGate-centric environments.
Graylog2 Server's event definition duplicate endpoint fails per-entity authorization, allowing any authenticated low-privilege user holding only the global `eventdefinitions:create` capability to clone event definitions they have not been granted access to. By issuing POST /events/definitions/{definitionId}/duplicate against arbitrary IDs, an attacker receives a full copy of the target definition - exposing detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings that may be restricted to other teams or roles. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the upstream fix is confirmed at commit 46a2eeba4cdbc1408ff4cbf7b466853a8acfb38d.
Unauthorized token deletion in Graylog's REST API (versions 6.2.0 through 6.3.11, 7.0.0-7.0.6, and 7.1.0-7.1.1) allows any authenticated user to revoke access tokens belonging to other accounts - including administrators and service accounts - by exploiting a misplaced permission check in the token revocation endpoint. The flaw does not expose token secret values but can invalidate privileged credentials and disrupt automated integrations that rely on access tokens. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available in versions 6.3.12, 7.0.7, and 7.1.2.
Log-record tampering in Graylog's FortiGate syslog parser enables unauthenticated network senders to overwrite or erase critical security-log fields - including srcip, dstip, date, time, and tz - or cause entire log messages to be silently discarded, creating a viable log-evasion primitive. Affected are Graylog Server versions prior to 6.3.12, 7.0.7, and 7.1.2 (all branches), and Graylog Forwarder prior to version 7.3, on any deployment ingesting FortiGate key-value syslog. No public exploit code exists and this is not in CISA KEV, but the attack requires no authentication and minimal crafting skill, making it a realistic threat to security-monitoring integrity in FortiGate-centric environments.
Graylog2 Server's event definition duplicate endpoint fails per-entity authorization, allowing any authenticated low-privilege user holding only the global `eventdefinitions:create` capability to clone event definitions they have not been granted access to. By issuing POST /events/definitions/{definitionId}/duplicate against arbitrary IDs, an attacker receives a full copy of the target definition - exposing detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings that may be restricted to other teams or roles. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the upstream fix is confirmed at commit 46a2eeba4cdbc1408ff4cbf7b466853a8acfb38d.