Description

Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request composite display fields without verifying that every selected field is readable. A user can retrieve protected values, including the password hash on a readable user record; ordinary users are limited to their own permitted records, while administrators can retrieve hashes for all users. This issue is fixed in versions 7.1.4 and 7.2.0-alpha.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.0",
  "pubDate": "2026-08-28T20:18:27.360Z",
  "pubdate": "2026-08-28T20:18:27.360Z",
  "executiveSummary": "Graylog versions 7.1.0 through 7.1.4 and 7.2.0-alpha.2 contain an improper authorization vulnerability within the System Catalog entity titles endpoint. This flaw permits authenticated users to perform unauthorized data retrieval due to insufficient access control checks on requested composite display fields.\nThe vulnerability allows an authenticated attacker to bypass field-level access restrictions, enabling the extraction of sensitive information, such as user password hashes. The severity of the impact is directly correlated to the attacker's existing privilege level: standard users are limited to their own records, whereas administrative accounts can compromise the credential data of all system users.\nThis issue stems from a failure to validate field readability during the processing of composite title requests, resulting in an information disclosure risk. Exploitation requires an active authenticated session. Organizations are strongly advised to update Graylog to the patched versions to eliminate the unauthorized data exposure path and maintain the confidentiality of user authentication credentials.",
  "technicalDetails": "The vulnerability resides within the EntityTitleServiceImpl.java file, specifically within the logic handling the System Catalog entity titles endpoint. The root cause is an improper authorization check during the resolution of composite display fields. When a request is made to the endpoint, the application fails to verify whether the requesting user possesses the necessary read permissions for every individual field included in the composite query.\nThe vulnerable component is identified as org.graylog2.rest.resources.system.contentpacks.titles.EntityTitleServiceImpl. During the retrieval process, the system aggregates requested data fields into a composite display title. Due to the lack of granular permission validation, the backend logic erroneously includes protected attributes that should be restricted based on the user's role-based access control (RBAC) settings.\nExploitation follows a specific attack flow: An authenticated user initiates a crafted request to the System Catalog entity titles endpoint, specifying fields that are typically restricted from their access level. Because the endpoint does not perform an exhaustive check on every field requested within the composite structure, the application backend fetches the sensitive data from the database—including internal attributes like password hashes—and includes them in the API response. The application treats these sensitive fields as part of the requested display data rather than restricted attributes.\nThe attack complexity is relatively low given the requirement of an authenticated session. For standard users, the impact is confined to their accessible entities, but for compromised or malicious administrative accounts, the vulnerability leads to a full-scale enumeration and exfiltration of password hashes for the entire user database. This elevates the risk significantly, as the exfiltrated hashes can be subjected to offline brute-force or dictionary attacks to facilitate full account takeovers.\nAffected versions include 7.1.0 up to 7.1.4 and the 7.2.0-alpha.2 release. The vulnerability was remediated by implementing explicit authorization logic within the EntityTitleServiceImpl class, ensuring that the system enforces field-level security checks before the composite object is constructed or serialized for the response. Post-exploitation impact involves full compromise of user credentials, facilitating lateral movement or persistence within the Graylog ecosystem."
}