Detections
Analytics
CVE-2026-69190
medium
Description
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.
References
https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-m9c2-85gv-8xr5
https://github.com/Graylog2/graylog2-server/releases/tag/7.1.4
https://github.com/Graylog2/graylog2-server/releases/tag/7.0.9
https://github.com/Graylog2/graylog2-server/releases/tag/6.3.14
https://github.com/Graylog2/graylog2-server/pull/26344
https://github.com/Graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42
https://github.com/Graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608
https://github.com/Graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2
https://github.com/Graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4