{"vulnerability": "CVE-2026-55867", "sightings": [{"uuid": "422eab17-8d9d-4156-8562-d83adbc9d3b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55867", "type": "seen", "source": "https://gist.github.com/alon710/4cae326e01f80455b82df9da7e1b2023", "content": "# CVE-2026-55867: CVE-2026-55867: Insecure Direct Object Reference in Graylog Access-Token Revocation\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55867\n\n## Summary\nAn Insecure Direct Object Reference (IDOR) vulnerability exists within the access-token revocation endpoint of Graylog. Authenticated users can exploit this flaw to delete access tokens belonging to other users, including high-privileged administrator accounts, thereby disrupting active integrations and API access.\n\n## TL;DR\nAn authenticated attacker with low privileges can revoke any user's access tokens via an IDOR vulnerability in Graylog's token removal API endpoint.\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network\n- **Privileges Required**: Low (Authenticated)\n- **CVSS v4.0 Score**: 5.3 (Medium)\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Graylog Server (graylog2-server)\n- **graylog2-server**: >= 6.2.0, < 6.3.12 (Fixed in: `6.3.12`)\n- **graylog2-server**: >= 7.0.0-alpha.1, < 7.0.7 (Fixed in: `7.0.7`)\n- **graylog2-server**: >= 7.1.0-alpha.1, < 7.1.2 (Fixed in: `7.1.2`)\n\n## Mitigation\n\n- Upgrade Graylog to versions 6.3.12, 7.0.7, 7.1.2, or later\n- Monitor API logs for anomalous DELETE requests to the user tokens endpoint\n- Restrict network access to the REST API interface to authenticated and trusted networks\n\n**Remediation Steps:**\n1. Identify current running versions of the Graylog server.\n2. Download the appropriate patch release (6.3.12, 7.0.7, or 7.1.2) corresponding to the deployed branch.\n3. Apply the update to all nodes in the Graylog cluster.\n4. Verify the installation by testing token revocation functionality with a non-admin account to ensure proper permission checks are enforced.\n\n## References\n\n- [GHSA-j769-9gv9-65gr: Graylog Insecure Direct Object Reference in UsersResource](https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-j769-9gv9-65gr)\n- [NVD - CVE-2026-55867](https://nvd.nist.gov/vuln/detail/CVE-2026-55867)\n- [Pull Request #26049](https://github.com/Graylog2/graylog2-server/pull/26049)\n- [Pull Request #26051](https://github.com/Graylog2/graylog2-server/pull/26051)\n- [Pull Request #26053](https://github.com/Graylog2/graylog2-server/pull/26053)\n- [Pull Request #26055](https://github.com/Graylog2/graylog2-server/pull/26055)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55867) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T13:31:53.424001Z"}]}