Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
Medium6.3CVE-2026-69190 · Published Sep 22, 2026
### Impact A vulnerability was found in Graylog's API endpoint for updating saved searches and dashboards. A user with edit permissions on a dashboard or saved search could grant owner permissions to an arbitrary account, which could then be used to delete the respective saved search or dashboard or to remove the original owner's access. ### Patches This issue has been patched in the following Graylog versions: `6.3.14`, `7.0.9`, `7.1.4`. Affected users should upgrade to one of these versions or above to remediate the vulnerability. Graylog Cloud has already been patched. ### Workaround There is no known workaround. Upgrading to a patched version is recommended. ### Credits Thanks to [Jan Kahmen](https://github.com/kah-ja), [turingpoint](https://www.turingpoint.de) for reporting.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.graylog2:graylog2-server Maven | >= 6.3.0, < 6.3.14 | 6.3.14 |
| >= 7.0.0, < 7.0.9 | 7.0.9 | |
| >= 7.1.0, < 7.1.4 | 7.1.4 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-639, CWE-862
- Also known as
- CVE-2026-69190
- github.com/Graylog2/graylog2-server/security/advisories/GHSA-m9c2-85gv-8xr5
- nvd.nist.gov/vuln/detail/CVE-2026-69190
- github.com/Graylog2/graylog2-server/pull/26344
- github.com/Graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4
- github.com/Graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2
- github.com/Graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608
- github.com/Graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42
- github.com/Graylog2/graylog2-server
- github.com/Graylog2/graylog2-server/releases/tag/6.3.14
- github.com/Graylog2/graylog2-server/releases/tag/7.0.9
- github.com/Graylog2/graylog2-server/releases/tag/7.1.4
More Graylog advisories
All Graylog| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 28 | Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens MediumAug 28 | Medium | 6.3.12+2 more |
| Aug 28 | Fortigate syslog message parser can be exploited to modify or delete fields from the original messageHigh7.5Aug 28 | High7.5 | 6.3.12+2 more |
| Aug 28 | Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fieldsMedium5.0Aug 28 | Medium5.0 | 7.1.4 |
| Jun 302025 | Graylog vulnerable to privilege escalation through API tokensHighJun 30, 2025 | High | 6.2.4+1 more |
| May 72025 | Graylog Allows Session Takeover via Insufficient HTML SanitizationHigh8.0May 7, 2025 | High8.0 | 6.0.14+1 more |
| May 72025 | Graylog Allows Stored Cross-Site Scripting via Files Plugin and API BrowserHigh7.3May 7, 2025 | High7.3 | 6.2.0 |