PT-2026-20392 · Graylog · Graylog

Published 2026-02-18 · Updated 2026-02-18 · CVE-2026-1436

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Graylog version 2.2.3

Description An improper access control issue exists in the Graylog API. An authenticated user can access other user's profiles without proper authorization checks by modifying the user ID in the URL. This allows listing valid users and accessing sensitive third-party information, such as names, email addresses, internal identifiers, and last activity. The API endpoint http://<IP>:12900/users/<my user> lacks object-level authorization validations.

Recommendations Apply appropriate object-level authorization validations to the /users/<my user> API endpoint.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-1436

Affected Products

Graylog

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-1436 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-graylog · Patch
• https://osv.dev/vulnerability/CVE-2026-1436 · Vendor Advisory
• https://twitter.com/CVEnew/status/2024123166482678227 · Twitter Post