5

CVE-2026-55425

Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields

Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request composite display fields without verifying that every selected field is readable. A user can retrieve protected values, including the password hash on a readable user record; ordinary users are limited to their own permitted records, while administrators can retrieve hashes for all users. This issue is fixed in versions 7.1.4 and 7.2.0-alpha.2.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerGraylog2
≫
Produkt graylog2-server
Version >= 7.1.0, < 7.1.4
Status affected
Version >= 7.2.0-alpha.1, < 7.2.0-alpha.2
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.3% 0.224
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 5 3.1 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CWE-213 Exposure of Sensitive Information Due to Incompatible Policies

The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.

https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-q79r-r9xg-r863
https://github.com/Graylog2/graylog2-server/pull/26284
https://github.com/Graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21
https://github.com/Graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5
https://github.com/Graylog2/graylog2-server/releases/tag/7.1.4
https://github.com/Graylog2/graylog2-server/releases/tag/7.2.0-alpha.2