CVE-2026-1436: Improper Access Control (IDOR) vulnerability in Graylog Web Interface
Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other user's profiles without proper authorization checks. Exploiting this vulnerability allows valid users of the system to be listed and sensitive third-party information to be accessed, such as names, email addresses, internal identifiers, and last activity. The endpoint 'http://<IP>:12900/users/<myuser>' does not implement object-level authorization validations.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1436?
CVE-2026-1436 is classified as a high-severity vulnerability due to its potential to expose sensitive user profiles.
How do I fix CVE-2026-1436?
To fix CVE-2026-1436, upgrade your Graylog API and Web Interface to the latest version that addresses this access control issue.
Who is affected by CVE-2026-1436?
CVE-2026-1436 affects users of Graylog API and Graylog Web Interface version 2.2.3.
What types of issues does CVE-2026-1436 allow attackers to exploit?
CVE-2026-1436 allows attackers to exploit improper access controls to view and modify other users' profiles.
Is user authentication sufficient to mitigate CVE-2026-1436?
No, user authentication alone is not sufficient as CVE-2026-1436 involves bypassing authorization checks.