CVE-2026-1436highCWE-639

CVE-2026-1436: high-severity vulnerability in Graylog Web Interface

Improper Access Control (IDOR) vulnerability in Graylog Web Interface

Published

Follow this CVE+ Monitor Graylog Web Interface

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.2%
Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other user's profiles without proper authorization checks. Exploiting this vulnerability allows valid users of the system to be listed and sensitive third-party information to be accessed, such as names, email addresses, internal identifiers, and last activity. The endpoint 'http://<IP>:12900/users/<my_user>' does not implement object-level authorization validations.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Graylog · Graylog Web Interface
Related CVEs — Graylog Web Interface

In the same product, most dangerous first.

CVE-2026-1435CRITICALIncorrect management of session invalidation vulnerability in Graylog Web InterfaceEPSS 0.4%CVE-2026-1437MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Graylog Web InterfaceEPSS 0.2%CVE-2026-1441MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Graylog Web InterfaceEPSS 0.2%CVE-2026-1440MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Graylog Web InterfaceEPSS 0.2%CVE-2026-1439MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Graylog Web InterfaceEPSS 0.2%CVE-2026-1438MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Graylog Web InterfaceEPSS 0.2%