TI-2026-01134 Aliases CVE-2026-1436 GHSA-ff7j-jwgr-hgxp

Improper Access Control (IDOR) vulnerability in Graylog Web Interface

LOW 31CWE-639Published 2026-02-18 · Updated 2026-02-18

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other user's profiles without proper authorization checks. Exploiting this vulnerability allows valid users of the system to be listed and sensitive third-party information to be accessed, such as names, email addresses, internal identifiers, and last activity. The endpoint 'http://<IP>:12900/users/<my_user>' does not implement object-level authorization validations.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00246 16th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Graylog2	Graylog Web Interface	2.2.3	—	No fix listed	CNA

Graylog Web Interface VendorGraylog2 Affected 2.2.3 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:graylog:graylog:2.2.3:::::::*	2.2.3	Vulnerable	Graylog2

cpe:2.3:a:graylog:graylog:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·Graylog2

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-1436
2026-10-03 Alias added: GHSA-ff7j-jwgr-hgxp

References

Patch 1

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-graylog

TI-2024-16341 graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request CVSS 3.1HIGH 8.8
TI-2023-21671 Insecure source port usage for DNS queries in Graylog CVSS 3.1MEDIUM 5.3
TI-2026-01133 Incorrect management of session invalidation vulnerability in Graylog Web Interface CVSS 4.0CRITICAL 9.3
TI-2023-21667 User session is still usable after logout in graylog2-server CVSS 3.1LOW 3.1
TI-2021-15624 A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate… CVSS 3.1CRITICAL 9.8
TI-2021-15623 A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to… CVSS 3.1CRITICAL 9.8

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences