CVE-2026-65011mediumCWE-862

CVE-2026-65011: medium-severity vulnerability in graylog2-server

Graylog2 Server Missing Permission Check on Event Definition Duplicate

Published · Updated

Follow this CVE+ Monitor graylog2-server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.4%
Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/{definitionId}/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private event definitions including detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings by duplicating them.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Graylog2 · graylog2-server
Related CVEs — graylog2-server

In the same product, most dangerous first.

CVE-2024-24824HIGHgraylog2-server vulnerable to instantiation of arbitrary classes triggered by API requestEPSS 34.7%CVE-2023-41044LOWPartial path traversal vulnerability in Support Bundle feature of GraylogEPSS 0.7%CVE-2026-55841HIGHGraylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original messageEPSS 0.6%CVE-2024-52506HIGHGraylog can leak other users' reports via concurrent PDF report renderingEPSS 0.6%CVE-2025-53106HIGHGraylog vulnerable to privilege escalation through API tokensEPSS 0.6%CVE-2026-55867MEDIUMGraylog token revocation endpoint allows authenticated users to delete other users’ access tokensEPSS 0.6%