CVE-2026-69190 json
Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
published last mo. modified last mo. also EUVD-2026-84038 , GHSA-m9c2-85gv-8xr5
- cvss
- 6.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.
Patch / fix
- maven org.graylog2:graylog2-server 6.3.14, 7.0.9, 7.1.4
- graylog graylog 6.3.14, 7.0.9, 7.1.4
- org.graylog2 graylog2-server 6.3.14, 7.0.9, 7.1.4
- github.com/Graylog2/graylog2-server@9303f39 commit
- github.com/Graylog2/graylog2-server@ac1c0b1 commit
- github.com/Graylog2/graylog2-server@c878796 commit
- github.com/Graylog2/graylog2-server@e98c667 commit
- github.com/Graylog2/graylog2-server#26344 pull request
- github.com/Graylog2/graylog2-server/releases/tag/6.3.14 release
- github.com/Graylog2/graylog2-server/releases/tag/7.0.9 release
- github.com/Graylog2/graylog2-server/releases/tag/7.1.4 release
Is CVE-2026-69190 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last mo.
Exploit prediction
0.42% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| GitHub | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.graylog2:graylog2-server | >=6.3.0, <6.3.14 >=7.0.0, <7.0.9 >=7.1.0, <7.1.4 |
6.3.14 7.0.9 7.1.4 |
Affected products
- Graylog2 graylog2-server
Classification
References
-
github.com
/Graylog2/graylog2-server/pull/26344
web
-
github.com
/Graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4
web
-
github.com
/Graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2
web
-
github.com
/Graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608
web
-
github.com
/Graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42
web
-
github.com
/Graylog2/graylog2-server/security/advisories/GHSA-m9c2-85gv-8xr5
web
-
github.com
/Graylog2/graylog2-server/releases/tag/6.3.14
web
-
github.com
/Graylog2/graylog2-server/releases/tag/7.0.9
web
-
github.com
/Graylog2/graylog2-server/releases/tag/7.1.4
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-69190
advisory
-
github.com
/Graylog2/graylog2-server
package
Sources
- CVE List CVE-2026-69190
- GitHub Advisory GHSA-m9c2-85gv-8xr5
- NVD CVE-2026-69190
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.