CVE-2026-69190: Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Graylogto a version that resolves this vulnerability.Fixed in 6.3.14 - Upgrade
Upgrade
Graylogto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
Graylogto a version that resolves this vulnerability.Fixed in 7.1.4
Event History
Frequently Asked Questions
Which deployments are affected?
Graylog versions from 6.3.0 up to the fixed releases are affected. The issue is fixed in 6.3.14, 7.0.9, and 7.1.4; Graylog Cloud was patched before the advisory was published.
What access does an attacker need?
An attacker needs a Graylog account with edit permission on a saved search or dashboard, but does not need to be its owner. They can use the view update API to grant owner permissions to an arbitrary account.
What can the newly granted owner do?
The account granted owner permissions can delete the saved search or dashboard, or remove the original owner's access.