Executive brief
Graylog2 Server, a popular log management and analysis platform, contains a security flaw that allows certain users to view private alert configurations they should not have access to. By using a 'duplicate' feature, a user with basic permissions can clone and then read sensitive event definitions, including detection queries and notification settings. This could lead to the exposure of internal monitoring logic and sensitive data handling procedures.
Technical details
A missing authorization vulnerability (CWE-862) exists in the POST /events/definitions/{definitionId}/duplicate endpoint of Graylog2 Server. While the application correctly enforces per-entity permissions for direct GET requests, the duplication endpoint only verified a global 'create' permission rather than checking if the user had 'read' access to the specific entity being cloned. An authenticated attacker with the low-privilege 'eventdefinitions:create' capability can exploit this to duplicate any event definition into their own account. Once duplicated, the attacker can view sensitive configuration details such as detection queries, aggregation thresholds, grouping fields, and notification bindings. The issue is fixed in versions following commit 46a2eeb, with backports provided for the 7.0 and 7.1 release branches.
Affected products
- Graylog2 graylog2-server <= 7.1.5, <= 7.0.10
Timeline
- 2026-07-06: disclosed: Issue reported on GitHub
- 2026-07-21: patched: Fix merged into master branch
- 2026-07-22: advisory: NVD publication date
References
- https://github.com/Graylog2/graylog2-server/commit/46a2eeba4cdbc1408ff4cbf7b466853a8acfb38d
- https://github.com/Graylog2/graylog2-server/issues/26590
- https://github.com/Graylog2/graylog2-server/pull/26706
- https://github.com/Graylog2/graylog2-server/pull/26718
- https://github.com/Graylog2/graylog2-server/pull/26719
- https://www.vulncheck.com/advisories/graylog2-server-missing-permission-check-on-event-definition-duplicate