CVE-2026-55867: Graylog token revocation endpoint IDOR

CVE-2026-55867 · Severity: medium · CVSS 4 · Published 2026-08-28

Graylog is a widely-used log management and analysis platform. A flaw in its token management system allows any authenticated user to delete other users' access tokens if they know the token identifier, potentially disrupting integrations and administrative access. This could impact operational security and cause service disruptions for organizations using token-based authentication with Graylog.

Technologies: org.graylog2:graylog2-server (Maven). Vendors: Graylog, Maven.

Quick answers

Is CVE-2026-55867 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55867 being exploited in the wild.
How severe is CVE-2026-55867?
Medium severity, with a CVSS score of 4, published 28 August 2026.
Which products and versions are affected?
Graylog Server 6.2.0 to 6.3.11, 7.0.0 to 7.0.6, 7.1.0 to 7.1.1; org.graylog2:graylog2-server (Maven) ECOSYSTEM:introduced=6.2.0,fixed=6.3.12.
Is there a fix for CVE-2026-55867?
Yes. org.graylog2:graylog2-server (Maven): upgrade to 6.3.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55867 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55867?
Check whether you run Graylog Server or org.graylog2:graylog2-server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.graylog2:graylog2-server (Maven): upgrade to 6.3.12 or later
    # set org.graylog2:graylog2-server to 6.3.12 in your pom.xml or build.gradle

Technical details

This is an insecure direct object reference (IDOR) vulnerability (CWE-639) in Graylog's token revocation API endpoint. An authenticated attacker with low privileges can craft requests to delete access tokens belonging to other users, including service accounts and administrators, by guessing or knowing valid token identifiers. The vulnerability requires prior authentication and network access to the Graylog API but does not require user interaction. The attack does not expose token contents but enables denial of service and integrity violations for token-based integrations. Patches are available in Graylog versions 6.3.12, 7.0.7, and 7.1.2 or later.

Affected products

  • Graylog Graylog Server 6.2.0 to 6.3.11, 7.0.0 to 7.0.6, 7.1.0 to 7.1.1

Identifiers

  • CVE-2026-55867
  • GHSA-j769-9gv9-65gr

Timeline

  • 2026-06-24: disclosed: Published to GitHub Advisory Database
  • 2026-08-28: advisory: Advisory updated and reviewed
  • 2026-06-24: patched: Patches released in versions 6.3.12, 7.0.7, and 7.1.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.