6.3
CVE-2026-69190
- EPSS 0.24%
- Veröffentlicht 21.09.2026 17:46:30
- Zuletzt bearbeitet 24.09.2026 21:17:43
- Erkennungen
Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerGraylog2
≫
Produkt
graylog2-server
Version
>= 6.3.0, < 6.3.14
Status
affected
Version
>= 7.0.0, < 7.0.9
Status
affected
Version
>= 7.1.0, < 7.1.4
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.24% | 0.154 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 6.3 | 2.8 | 3.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
|
CWE-639 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-862 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
https://github.com/Graylog2/graylog2-server/releases/tag/7.1.4
https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-m9c2-85gv-8xr5
https://github.com/Graylog2/graylog2-server/pull/26344
https://github.com/Graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4
https://github.com/Graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2
https://github.com/Graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608
https://github.com/Graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42
https://github.com/Graylog2/graylog2-server/releases/tag/6.3.14
https://github.com/Graylog2/graylog2-server/releases/tag/7.0.9