Medium severity6.3NVD Advisory· Published Sep 21, 2026· Updated Sep 24, 2026
CVE-2026-69190
CVE-2026-69190
Description
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.graylog2:graylog2-serverMaven | >= 6.3.0, < 6.3.14 | 6.3.14 |
org.graylog2:graylog2-serverMaven | >= 7.0.0, < 7.0.9 | 7.0.9 |
org.graylog2:graylog2-serverMaven | >= 7.1.0, < 7.1.4 | 7.1.4 |
Affected products
2- Range: 6.3.0 - 6.3.13, 7.0.0 - 7.0.8, 7.1.0 - 7.1.3
Patches
Vulnerability mechanics
References
11- github.com/advisories/GHSA-m9c2-85gv-8xr5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-69190ghsaADVISORY
- github.com/Graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4nvdWEB
- github.com/Graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2nvdWEB
- github.com/Graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608nvdWEB
- github.com/Graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42nvdWEB
- github.com/Graylog2/graylog2-server/pull/26344nvdWEB
- github.com/Graylog2/graylog2-server/releases/tag/6.3.14nvdWEB
- github.com/Graylog2/graylog2-server/releases/tag/7.0.9nvdWEB
- github.com/Graylog2/graylog2-server/releases/tag/7.1.4nvdWEB
- github.com/Graylog2/graylog2-server/security/advisories/GHSA-m9c2-85gv-8xr5nvdWEB
News mentions
0No linked articles in our index yet.