Description

Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-21T18:17:10.210Z",
  "pubdate": "2026-09-21T18:17:10.210Z",
  "executiveSummary": "A critical improper authorization vulnerability exists within the Graylog log management platform, specifically affecting the view update API for saved searches and dashboards.\nThe vulnerability allows an authenticated user, who possesses edit permissions for a specific entity but lacks actual ownership, to manipulate the entity's access control configuration.\nBy crafting a malicious shareRequest within the API call, an attacker can elevate an arbitrary user account to owner status for the target entity.\nThe impact of this flaw is severe, as the unauthorized owner can perform destructive actions, such as permanently deleting the dashboard or search, or revoking access from the legitimate original owner.\nThis vulnerability affects Graylog versions 6.3.0 through 6.3.13, 7.0.x before 7.0.9, and 7.1.x before 7.1.4.\nExploitation requires the attacker to have at least basic edit privileges on the targeted entity.\nGraylog Cloud instances have already been remediated, and users of self-hosted versions must upgrade to the specified patched versions to secure their environments.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient authorization check within the Graylog API endpoint responsible for updating saved searches and dashboards. While the system correctly restricts modification of the entity content based on edit permissions, it fails to validate the requester's ownership status when processing the shareRequest object during the update operation.\nThe API permits an authenticated user with edit-level access to submit a payload that includes a shareRequest configuration. Normally, this functionality is intended for owners to delegate or share access; however, the lack of server-side validation allows a non-owner to define arbitrary access control entries. An attacker can use this mechanism to inject their own account, or a controlled third-party account, into the access control list (ACL) of the entity with full owner privileges.\nThe attack flow follows a structured sequence: 1) The attacker identifies a target saved search or dashboard for which they possess edit rights. 2) The attacker initiates an API request to the view update endpoint. 3) The attacker modifies the request payload to include a specifically crafted shareRequest that elevates a chosen user ID to owner status. 4) The Graylog server processes the update, bypassing the ownership verification check, and commits the elevated permissions to the persistent storage.\nOnce the target account is granted owner privileges, the attacker effectively bypasses the intended multi-tenancy or access control boundaries. The post-exploitation impact allows the attacker to perform full administrative lifecycle management on the entity. This includes the complete deletion of critical dashboard assets and log search queries, which could lead to significant data management disruption or loss of observability. Furthermore, the attacker can use the newly acquired owner permissions to 'lock out' the original creator by removing their permissions, thereby achieving total control over the object's lifecycle.\nThis vulnerability is restricted to the internal view update API and requires the attacker to have a valid, authenticated session within the Graylog instance. There is no requirement for administrative system-level privileges; the vulnerability is scoped to the application-layer authorization logic governing user-created entities. Affected versions include the 6.3.x branch up to 6.3.14, the 7.0.x branch up to 7.0.9, and the 7.1.x branch up to 7.1.4."
}