Advisoriesby IbisGraylogGHSA-m9c2-85gv-8xr5
Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
Fix: upgrade to 6.3.14 or later (3 fixed versions below)
Impact
A vulnerability was found in Graylog's API endpoint for updating saved searches and dashboards. A user with edit permissions on a dashboard or saved search could grant owner permissions to an arbitrary account, which could then be used to delete the respective saved search or dashboard or to remove the original owner's access.
Patches
This issue has been patched in the following Graylog versions: 6.3.14, 7.0.9, 7.1.4. Affected users should upgrade to one of these versions or above to remediate the vulnerability.
Graylog Cloud has already been patched.
Workaround
There is no known workaround. Upgrading to a patched version is recommended.
Credits
Thanks to [Jan Kahmen](https://github.com/kah-ja), [turingpoint](https://www.turingpoint.de) for reporting.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.graylog2:graylog2-server Maven | >= 6.3.0, < 6.3.14 | 6.3.14 |
| >= 7.0.0, < 7.0.9 | 7.0.9 | |
| >= 7.1.0, < 7.1.4 | 7.1.4 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-639, CWE-862
- Also known as
- CVE-2026-69190
- github.com/Graylog2/graylog2-server/security/advisories/GHSA-m9c2-85gv-8xr5
- nvd.nist.gov/vuln/detail/CVE-2026-69190
- github.com/Graylog2/graylog2-server/pull/26344
- github.com/Graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4
- github.com/Graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2
- github.com/Graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608
- github.com/Graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42
- github.com/Graylog2/graylog2-server
- github.com/Graylog2/graylog2-server/releases/tag/6.3.14
- github.com/Graylog2/graylog2-server/releases/tag/7.0.9
- github.com/Graylog2/graylog2-server/releases/tag/7.1.4
More Graylog advisories
All Graylog
Graylog token revocation endpoint allows authenticated users to delete other users’ access tokensCVE-2026-55867fixed in 6.3.12 +2Fortigate syslog message parser can be exploited to modify or delete fields from the original messageCVE-2026-55841fixed in 6.3.12 +2Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fieldsCVE-2026-55425fixed in 7.1.4Graylog vulnerable to privilege escalation through API tokensCVE-2025-53106fixed in 6.2.4 +1Graylog Allows Session Takeover via Insufficient HTML SanitizationCVE-2025-46827fixed in 6.0.14 +1Graylog Allows Stored Cross-Site Scripting via Files Plugin and API BrowserGHSA-q9q2-3ppx-mwqffixed in 6.2.0