DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55867: CVE-2026-55867: Insecure Direct Object Reference in Graylog Access-Token Revocation

#security #cve #cybersecurity

CVE-2026-55867: Insecure Direct Object Reference in Graylog Access-Token Revocation

Vulnerability ID: CVE-2026-55867
CVSS Score: 5.3
Published: 2026-08-28

An Insecure Direct Object Reference (IDOR) vulnerability exists within the access-token revocation endpoint of Graylog. Authenticated users can exploit this flaw to delete access tokens belonging to other users, including high-privileged administrator accounts, thereby disrupting active integrations and API access.

TL;DR

An authenticated attacker with low privileges can revoke any user's access tokens via an IDOR vulnerability in Graylog's token removal API endpoint.

Technical Details

  • CWE ID: CWE-639
  • Attack Vector: Network
  • Privileges Required: Low (Authenticated)
  • CVSS v4.0 Score: 5.3 (Medium)
  • Exploit Status: None
  • KEV Status: Not Listed

Affected Systems

  • Graylog Server (graylog2-server)
  • graylog2-server: >= 6.2.0, < 6.3.12 (Fixed in: 6.3.12)
  • graylog2-server: >= 7.0.0-alpha.1, < 7.0.7 (Fixed in: 7.0.7)
  • graylog2-server: >= 7.1.0-alpha.1, < 7.1.2 (Fixed in: 7.1.2)

Code Analysis

Commit: 41d3745

Fix token deletion authorization check

@@ -874,24 +874,25 @@
Enter fullscreen mode Exit fullscreen mode

Commit: 4f28013

Token deletion auth bypass fix validation

@@ -874,24 +874,25 @@
Enter fullscreen mode Exit fullscreen mode

Commit: 84b0ffa

Authorization verification improvement

@@ -874,24 +874,25 @@
Enter fullscreen mode Exit fullscreen mode

Commit: e5accc5

Secure token removal endpoint

@@ -874,24 +874,25 @@
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade Graylog to versions 6.3.12, 7.0.7, 7.1.2, or later
  • Monitor API logs for anomalous DELETE requests to the user tokens endpoint
  • Restrict network access to the REST API interface to authenticated and trusted networks

Remediation Steps:

  1. Identify current running versions of the Graylog server.
  2. Download the appropriate patch release (6.3.12, 7.0.7, or 7.1.2) corresponding to the deployed branch.
  3. Apply the update to all nodes in the Graylog cluster.
  4. Verify the installation by testing token revocation functionality with a non-admin account to ensure proper permission checks are enforced.

References

Read the full report for CVE-2026-55867 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)