Log in Start free

Vulnerability · Published Aug 28, 2026 · Assigned by GitHub_M

CVE-2026-55867Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

Medium 5.3

In plain English

A medium-severity authorization bypass via user-controlled key in graylog2-server from Graylog2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.6%top 52.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId}/tokens/{idOrToken} endpoint implemented by UsersResource.revokeToken() in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERS_TOKENREMOVE permission against the attacker-controlled userId path parameter before resolving the token selected by idOrToken. An authenticated user can provide an authorized userId while accessTokenService.loadById() or accessTokenService.load() resolves a token belonging to another user, including a service account or administrator, after which accessTokenService.destroy() deletes that token without checking AccessToken.getUserName(). The issue does not expose token contents, but unauthorized deletion causes integrity impact and can disrupt access-token-based integrations. This issue is fixed in versions 6.3.12, 7.0.7, and 7.1.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.graylog2:graylog2-server6.3.12GHSA-j769-9gv9-65gr
Mavenorg.graylog2:graylog2-server7.0.7GHSA-j769-9gv9-65gr
Mavenorg.graylog2:graylog2-server7.1.2GHSA-j769-9gv9-65gr

Affected products (as reported)

VendorProductVersions
Graylog2 graylog2-server >= 6.2.0, < 6.3.12>= 7.0.0-alpha.1, < 7.0.7>= 7.1.0-alpha.1, < 7.1.2

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

References