Vulnerability-Lookup

CVE-2026-55867 (GCVE-0-2026-55867)

Vulnerability from cvelistv5 – Published: 2026-08-28 22:14 – Updated: 2026-08-31 18:38

Title

Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

Summary

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId}/tokens/{idOrToken} endpoint implemented by UsersResource.revokeToken() in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERS_TOKENREMOVE permission against the attacker-controlled userId path parameter before resolving the token selected by idOrToken. An authenticated user can provide an authorized userId while accessTokenService.loadById() or accessTokenService.load() resolves a token belonging to another user, including a service account or administrator, after which accessTokenService.destroy() deletes that token without checking AccessToken.getUserName(). The issue does not expose token contents, but unauthorized deletion causes integrity impact and can disrupt access-token-based integrations. This issue is fixed in versions 6.3.12, 7.0.7, and 7.1.2.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-31 18:38 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M mitre root

References

9 references

URL	Tags
https://github.com/Graylog2/graylog2-server/secur…	x_refsource_CONFIRM
https://github.com/Graylog2/graylog2-server/pull/26049	x_refsource_MISC
https://github.com/Graylog2/graylog2-server/pull/26051	x_refsource_MISC
https://github.com/Graylog2/graylog2-server/pull/26053	x_refsource_MISC
https://github.com/Graylog2/graylog2-server/pull/26055	x_refsource_MISC
https://github.com/Graylog2/graylog2-server/commi…	x_refsource_MISC
https://github.com/Graylog2/graylog2-server/commi…	x_refsource_MISC
https://github.com/Graylog2/graylog2-server/commi…	x_refsource_MISC
https://github.com/Graylog2/graylog2-server/commi…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
Graylog2	graylog2-server	Affected: >= 6.2.0, < 6.3.12 Affected: >= 7.0.0-alpha.1, < 7.0.7 Affected: >= 7.1.0-alpha.1, < 7.1.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55867",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T18:38:06.134222Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T18:38:29.854Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "graylog2-server",
          "vendor": "Graylog2",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.2.0, \u003c 6.3.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0-alpha.1, \u003c 7.0.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.1.0-alpha.1, \u003c 7.1.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId}/tokens/{idOrToken} endpoint implemented by UsersResource.revokeToken() in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERS_TOKENREMOVE permission against the attacker-controlled userId path parameter before resolving the token selected by idOrToken. An authenticated user can provide an authorized userId while accessTokenService.loadById() or accessTokenService.load() resolves a token belonging to another user, including a service account or administrator, after which accessTokenService.destroy() deletes that token without checking AccessToken.getUserName(). The issue does not expose token contents, but unauthorized deletion causes integrity impact and can disrupt access-token-based integrations. This issue is fixed in versions 6.3.12, 7.0.7, and 7.1.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T22:14:35.743Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-j769-9gv9-65gr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-j769-9gv9-65gr"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/pull/26049",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/pull/26049"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/pull/26051",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/pull/26051"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/pull/26053",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/pull/26053"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/pull/26055",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/pull/26055"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/commit/41d3745d0e52736d06c07d279ca0d72c1616df4c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/commit/41d3745d0e52736d06c07d279ca0d72c1616df4c"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/commit/4f280138b53dc3bbb5749213e8cb1c8e372f23a2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/commit/4f280138b53dc3bbb5749213e8cb1c8e372f23a2"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/commit/84b0ffa0bdf918f6edd2bb23a47254088634b1fc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/commit/84b0ffa0bdf918f6edd2bb23a47254088634b1fc"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/commit/e5accc5f4ce48bd61b84bb8e5a13d21f8eac3da5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/commit/e5accc5f4ce48bd61b84bb8e5a13d21f8eac3da5"
        }
      ],
      "source": {
        "advisory": "GHSA-j769-9gv9-65gr",
        "discovery": "UNKNOWN"
      },
      "title": "Graylog token revocation endpoint allows authenticated users to delete other users\u2019 access tokens"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55867",
    "datePublished": "2026-08-28T22:14:35.743Z",
    "dateReserved": "2026-06-17T16:44:40.996Z",
    "dateUpdated": "2026-08-31T18:38:29.854Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55867",
      "date": "2026-09-03",
      "epss": "0.00335",
      "percentile": "0.26271"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-55867\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-28T23:17:09.300\",\"lastModified\":\"2026-08-31T19:17:08.033\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId}/tokens/{idOrToken} endpoint implemented by UsersResource.revokeToken() in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERS_TOKENREMOVE permission against the attacker-controlled userId path parameter before resolving the token selected by idOrToken. An authenticated user can provide an authorized userId while accessTokenService.loadById() or accessTokenService.load() resolves a token belonging to another user, including a service account or administrator, after which accessTokenService.destroy() deletes that token without checking AccessToken.getUserName(). The issue does not expose token contents, but unauthorized deletion causes integrity impact and can disrupt access-token-based integrations. This issue is fixed in versions 6.3.12, 7.0.7, and 7.1.2.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"Graylog2\",\"product\":\"graylog2-server\",\"versions\":[{\"version\":\"\u003e= 6.2.0, \u003c 6.3.12\",\"status\":\"affected\"},{\"version\":\"\u003e= 7.0.0-alpha.1, \u003c 7.0.7\",\"status\":\"affected\"},{\"version\":\"\u003e= 7.1.0-alpha.1, \u003c 7.1.2\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-31T18:38:06.134222Z\",\"id\":\"CVE-2026-55867\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-639\"}]}],\"references\":[{\"url\":\"https://github.com/Graylog2/graylog2-server/commit/41d3745d0e52736d06c07d279ca0d72c1616df4c\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Graylog2/graylog2-server/commit/4f280138b53dc3bbb5749213e8cb1c8e372f23a2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Graylog2/graylog2-server/commit/84b0ffa0bdf918f6edd2bb23a47254088634b1fc\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Graylog2/graylog2-server/commit/e5accc5f4ce48bd61b84bb8e5a13d21f8eac3da5\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Graylog2/graylog2-server/pull/26049\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Graylog2/graylog2-server/pull/26051\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Graylog2/graylog2-server/pull/26053\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Graylog2/graylog2-server/pull/26055\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-j769-9gv9-65gr\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-55867\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-31T18:38:06.134222Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-31T18:38:11.026Z\"}}], \"cna\": {\"title\": \"Graylog token revocation endpoint allows authenticated users to delete other users\\u2019 access tokens\", \"source\": {\"advisory\": \"GHSA-j769-9gv9-65gr\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"Graylog2\", \"product\": \"graylog2-server\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 6.2.0, \u003c 6.3.12\"}, {\"status\": \"affected\", \"version\": \"\u003e= 7.0.0-alpha.1, \u003c 7.0.7\"}, {\"status\": \"affected\", \"version\": \"\u003e= 7.1.0-alpha.1, \u003c 7.1.2\"}]}], \"references\": [{\"url\": \"https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-j769-9gv9-65gr\", \"name\": \"https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-j769-9gv9-65gr\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/Graylog2/graylog2-server/pull/26049\", \"name\": \"https://github.com/Graylog2/graylog2-server/pull/26049\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Graylog2/graylog2-server/pull/26051\", \"name\": \"https://github.com/Graylog2/graylog2-server/pull/26051\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Graylog2/graylog2-server/pull/26053\", \"name\": \"https://github.com/Graylog2/graylog2-server/pull/26053\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Graylog2/graylog2-server/pull/26055\", \"name\": \"https://github.com/Graylog2/graylog2-server/pull/26055\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Graylog2/graylog2-server/commit/41d3745d0e52736d06c07d279ca0d72c1616df4c\", \"name\": \"https://github.com/Graylog2/graylog2-server/commit/41d3745d0e52736d06c07d279ca0d72c1616df4c\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Graylog2/graylog2-server/commit/4f280138b53dc3bbb5749213e8cb1c8e372f23a2\", \"name\": \"https://github.com/Graylog2/graylog2-server/commit/4f280138b53dc3bbb5749213e8cb1c8e372f23a2\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Graylog2/graylog2-server/commit/84b0ffa0bdf918f6edd2bb23a47254088634b1fc\", \"name\": \"https://github.com/Graylog2/graylog2-server/commit/84b0ffa0bdf918f6edd2bb23a47254088634b1fc\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Graylog2/graylog2-server/commit/e5accc5f4ce48bd61b84bb8e5a13d21f8eac3da5\", \"name\": \"https://github.com/Graylog2/graylog2-server/commit/e5accc5f4ce48bd61b84bb8e5a13d21f8eac3da5\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId}/tokens/{idOrToken} endpoint implemented by UsersResource.revokeToken() in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERS_TOKENREMOVE permission against the attacker-controlled userId path parameter before resolving the token selected by idOrToken. An authenticated user can provide an authorized userId while accessTokenService.loadById() or accessTokenService.load() resolves a token belonging to another user, including a service account or administrator, after which accessTokenService.destroy() deletes that token without checking AccessToken.getUserName(). The issue does not expose token contents, but unauthorized deletion causes integrity impact and can disrupt access-token-based integrations. This issue is fixed in versions 6.3.12, 7.0.7, and 7.1.2.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-639\", \"description\": \"CWE-639: Authorization Bypass Through User-Controlled Key\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-28T22:14:35.743Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-55867\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-31T18:38:29.854Z\", \"dateReserved\": \"2026-06-17T16:44:40.996Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-28T22:14:35.743Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55867

Vulnerability from fkie_nvd - Published: 2026-08-28 23:17 - Updated: 2026-08-31 19:17

Severity

5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/commit/41d3745d0e52736d06c07d279ca0d72c1616df4c
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/commit/4f280138b53dc3bbb5749213e8cb1c8e372f23a2
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/commit/84b0ffa0bdf918f6edd2bb23a47254088634b1fc
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/commit/e5accc5f4ce48bd61b84bb8e5a13d21f8eac3da5
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/pull/26049
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/pull/26051
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/pull/26053
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/pull/26055
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-j769-9gv9-65gr

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "graylog2-server",
          "vendor": "Graylog2",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.2.0, \u003c 6.3.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0-alpha.1, \u003c 7.0.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.1.0-alpha.1, \u003c 7.1.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId}/tokens/{idOrToken} endpoint implemented by UsersResource.revokeToken() in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERS_TOKENREMOVE permission against the attacker-controlled userId path parameter before resolving the token selected by idOrToken. An authenticated user can provide an authorized userId while accessTokenService.loadById() or accessTokenService.load() resolves a token belonging to another user, including a service account or administrator, after which accessTokenService.destroy() deletes that token without checking AccessToken.getUserName(). The issue does not expose token contents, but unauthorized deletion causes integrity impact and can disrupt access-token-based integrations. This issue is fixed in versions 6.3.12, 7.0.7, and 7.1.2."
    }
  ],
  "id": "CVE-2026-55867",
  "lastModified": "2026-08-31T19:17:08.033",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55867",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-31T18:38:06.134222Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-28T23:17:09.300",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/commit/41d3745d0e52736d06c07d279ca0d72c1616df4c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/commit/4f280138b53dc3bbb5749213e8cb1c8e372f23a2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/commit/84b0ffa0bdf918f6edd2bb23a47254088634b1fc"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/commit/e5accc5f4ce48bd61b84bb8e5a13d21f8eac3da5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/pull/26049"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/pull/26051"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/pull/26053"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/pull/26055"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-j769-9gv9-65gr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-J769-9GV9-65GR

Vulnerability from github – Published: 2026-08-28 22:15 – Updated: 2026-08-28 22:15

Summary

Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

Details

Impact

Graylog contains an insecure direct object reference (IDOR) vulnerability in the token revocation endpoint. An authenticated user can delete access tokens belonging to other users, including service account tokens and administrator tokens, if they know or can guess a valid token identifier.

The issue does not expose token contents, but it allows unauthorized token deletion, leading to integrity impact and potential availability impact for access token based integrations.

Patches

The issue has been fixed in the following Graylog versions: 6.3.12, 7.0.7, 7.1.2. Users should upgrade to one of these versions or above to remediate the vulnerability.

Graylog Cloud has already been patched.

Workarounds

There are no feasible workarounds for this issue. Upgrading to a patched version is recommended.

Customers using Graylog Enterprise or Security can review the audit log^1 for suspicious activity. Audit log lines for successful token deletions begin with access token deleted from user.

Credits

Thanks to michaelddickenson and sreelim for reporting.

Severity

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.graylog2:graylog2-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.3.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.graylog2:graylog2-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.graylog2:graylog2-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.1.0"
            },
            {
              "fixed": "7.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55867"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T22:15:41Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nGraylog contains an insecure direct object reference (IDOR) vulnerability in the token revocation endpoint. An authenticated user can delete access tokens belonging to other users, including service account tokens and administrator tokens, if they know or can guess a valid token identifier.\n\nThe issue does not expose token contents, but it allows unauthorized token deletion, leading to integrity impact and potential availability impact for access token based integrations.\n\n### Patches\n\nThe issue has been fixed in the following Graylog versions: `6.3.12`, `7.0.7`, `7.1.2`. Users should upgrade to one of these versions or above to remediate the vulnerability.\n\nGraylog Cloud has already been patched.\n\n### Workarounds\n\nThere are no feasible workarounds for this issue. Upgrading to a patched version is recommended.\n\nCustomers using Graylog Enterprise or Security can review the audit log[^1] for suspicious activity. Audit log lines for successful token deletions begin with `access token deleted from user`. \n\n### Credits\n\nThanks to [michaelddickenson](https://github.com/michaelddickenson) and [sreelim](https://github.com/sreelim) for reporting.\n\n\n[^1]: https://go2docs.graylog.org/current/interacting_with_your_log_data/audit_log.html",
  "id": "GHSA-j769-9gv9-65gr",
  "modified": "2026-08-28T22:15:41Z",
  "published": "2026-08-28T22:15:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-j769-9gv9-65gr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/pull/26049"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/pull/26051"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/pull/26053"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/pull/26055"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/commit/41d3745d0e52736d06c07d279ca0d72c1616df4c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/commit/4f280138b53dc3bbb5749213e8cb1c8e372f23a2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/commit/84b0ffa0bdf918f6edd2bb23a47254088634b1fc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/commit/e5accc5f4ce48bd61b84bb8e5a13d21f8eac3da5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Graylog2/graylog2-server"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Graylog token revocation endpoint allows authenticated users to delete other users\u2019 access tokens"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-55867 (GCVE-0-2026-55867)

FKIE_CVE-2026-55867

GHSA-J769-9GV9-65GR

Impact

Patches

Workarounds

Credits

Tags

Sightings

Nomenclature