CVEvulnerability
CVE-2026-69190
6.3 MEDIUM
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-09-21
- Last modified
- 2026-09-24
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-639, CWE-862
Description
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.
Related
References
- https://github.com/Graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4 github.com
- https://github.com/Graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2 github.com
- https://github.com/Graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608 github.com
- https://github.com/Graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42 github.com
- https://github.com/Graylog2/graylog2-server/pull/26344 github.com
- https://github.com/Graylog2/graylog2-server/releases/tag/6.3.14 github.com
- https://github.com/Graylog2/graylog2-server/releases/tag/7.0.9 github.com
- https://github.com/Graylog2/graylog2-server/releases/tag/7.1.4 github.com
- https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-m9c2-85gv-8xr5 github.com