CVE-2026-55425

Graylog from 6.2.0 to 6.3.12, 7.0.7, and 7.1.2 has a vulnerability in the DELETE /users/{userId}/tokens/{idOrToken} endpoint where USERS_TOKENREMOVE permission is checked against the attacker-controlled userId path parameter before resolving the token selected by idOrToken. An authenticated user can provide an authorized userId while loadById() or load() resolves a token belonging to another user, including a service account or administrator, after which destroy() deletes that token without checking AccessToken.getUserName(). The issue does not expose token contents, but unauthorized deletion causes integrity impact and can disrupt access-token-based integrations.

Vulnerability in Graylog Server before versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder before 7.3. The FortiGate syslog parser mishandles fields inside quoted values, allowing an unauthenticated sender to manipulate security-log fields or evade logging to obscure malicious activity.

Graylog, a log management platform, uses a single source port for DNS queries, which goes against recommended security practices. This could allow DNS cache poisoning attacks, where an external attacker can inject forged DNS responses into Graylog's cache.

Graylog has a partial path traversal vulnerability in the `Support Bundle` feature that allows an attacker with valid Admin role credentials to download or delete files in sibling directories. The issue is caused by improper input validation in an HTTP API resource.

In the Graylog platform, in multi-node clusters, a user session may still be used for API requests after logout until it reaches its original expiry time. Each node maintains a local cache of user sessions, leading to situations where other nodes may still accept the session after it has been removed from the local cache.