CVE-2026-55867
MediumCVSS 5.3Summary
Graylog from 6.2.0 to 6.3.12, 7.0.7, and 7.1.2 has a vulnerability in the DELETE /users/{userId}/tokens/{idOrToken} endpoint where USERS_TOKENREMOVE permission is checked against the attacker-controlled userId path parameter before resolving the token selected by idOrToken. An authenticated user can provide an authorized userId while loadById() or load() resolves a token belonging to another user, including a service account or administrator, after which destroy() deletes that token without checking AccessToken.getUserName(). The issue does not expose token contents, but unauthorized deletion causes integrity impact and can disrupt access-token-based integrations.
Risk Assessment
Unauthorized deletion of tokens can disrupt systems integrated with Graylog, leading to access interruptions and integrity compromise.
Recommendation
Immediately upgrade Graylog to versions 6.3.12, 7.0.7, or 7.1.2 which contain the fix.
Other vulnerabilities in Graylog
See all- CVE-2026-55841High
Vulnerability in Graylog Server before versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder before 7.3. The FortiGate syslog parser mishandles fields inside quoted values, allowing an unauthenticated sender to manipulate security-log fields or evade logging to obscure malicious activity.
- CVE-2026-55425Medium
Graylog from 7.1.0 until 7.1.4 and 7.2.0-alpha.2 allows an authenticated user to request composite display fields in the System Catalog entity titles endpoint without verifying that every selected field is readable. A user can retrieve protected values, including password hashes on readable user records; ordinary users are limited to their own records, while administrators can retrieve hashes for all users.
- CVE-2023-41045Low
Graylog, a log management platform, uses a single source port for DNS queries, which goes against recommended security practices. This could allow DNS cache poisoning attacks, where an external attacker can inject forged DNS responses into Graylog's cache.
- CVE-2023-41044Low
Graylog has a partial path traversal vulnerability in the `Support Bundle` feature that allows an attacker with valid Admin role credentials to download or delete files in sibling directories. The issue is caused by improper input validation in an HTTP API resource.
- CVE-2023-41041Low
In the Graylog platform, in multi-node clusters, a user session may still be used for API requests after logout until it reaches its original expiry time. Each node maintains a local cache of user sessions, leading to situations where other nodes may still accept the session after it has been removed from the local cache.
Original NVD description (English source)
Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId}/tokens/{idOrToken} endpoint implemented by UsersResource.revokeToken() in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERS_TOKENREMOVE permission against the attacker-controlled userId path parameter before resolving the token selected by idOrToken. An authenticated user can provide an authorized userId while accessTokenService.loadById() or accessTokenService.load() resolves a token belonging to another user, including a service account or administrator, after which accessTokenService.destroy() deletes that token without checking AccessToken.getUserName(). The issue does not expose token contents, but unauthorized deletion causes integrity impact and can disrupt access-token-based integrations. This issue is fixed in versions 6.3.12, 7.0.7, and 7.1.2.