CVE-2026-69190Medium· 6.3▾ SunlitGraylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareReque…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.4%
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.graylog2:graylog2-server >= 6.3.0, < 6.3.14org.graylog2:graylog2-server >= 7.0.0, < 7.0.9org.graylog2:graylog2-server >= 7.1.0, < 7.1.4Patched in:
org.graylog2:graylog2-server 6.3.14org.graylog2:graylog2-server 7.0.9org.graylog2:graylog2-server 7.1.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-92789Medium· 6.5Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects
CVE-2026-55867MediumGraylog is a free and open log management platform
CVE-2026-55425Medium· 5.0Graylog is a free and open log management platform
CVE-2026-102298High· 7.5In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check
CVE-2025-32781Medium· 6.5Apollo is a reliable configuration management system suitable for microservice configuration management scenarios
CVE-2025-8887Medium· 6.1Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Information Systems Inc