Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
cve-program · CVE-2026-69190
PublishedGraylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-69190 · CVE overview and exploitation status
cve-program · CVE-2026-69190
- https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-m9c2-85gv-8xr5
- https://github.com/Graylog2/graylog2-server/pull/26344
- https://github.com/Graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4
- https://github.com/Graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2
- https://github.com/Graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608
- https://github.com/Graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42
- https://github.com/Graylog2/graylog2-server/releases/tag/6.3.14
- https://github.com/Graylog2/graylog2-server/releases/tag/7.0.9
- https://github.com/Graylog2/graylog2-server/releases/tag/7.1.4
Related changes
Linked by CVE identifierNo related changes are available here.