Vulnerability · Published Feb 18, 2026 · Assigned by INCIBE

CVE-2026-1436Improper Access Control (IDOR) vulnerability in Graylog Web Interface

High 7.1

In plain English

A high-severity authorization bypass via user-controlled key in Graylog Web Interface from Graylog. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.2%top 84.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other user's profiles without proper authorization checks. Exploiting this vulnerability allows valid users of the system to be listed and sensitive third-party information to be accessed, such as names, email addresses, internal identifiers, and last activity. The endpoint 'http://<IP>:12900/users/<my_user>' does not implement object-level authorization validations.

Affected products (as reported)

Vendor	Product	Versions
Graylog	Graylog Web Interface	2.2.3

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-graylog patch