Medium severity · published Jul 22, 2026
CVE-2026-65011
Graylog2 Server Missing Permission Check on Event Definition Duplicate
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/{definitionId}/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private event definitions including detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings by duplicating them.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
graylog2-server · Graylog2
through 7.1.5; through 7.0.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-65011
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-65011
github.com
https://github.com/Graylog2/graylog2-server/commit/46a2eeba4cdbc1408ff4cbf7b466853a8acfb38d
github.com
https://github.com/Graylog2/graylog2-server/issues/26590
github.com
https://github.com/Graylog2/graylog2-server/pull/26706
github.com
https://github.com/Graylog2/graylog2-server/pull/26718
github.com
https://github.com/Graylog2/graylog2-server/pull/26719
www.vulncheck.com
https://www.vulncheck.com/advisories/graylog2-server-missing-permission-check-on-event-definition-duplicate
More from graylog2-server
8.8
CVE-2025-53106
Graylog vulnerable to privilege escalation through API tokens
8.8
CVE-2024-24824
graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request
7.5
CVE-2026-55841
Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message
6.5
CVE-2026-92789
Graylog through 7.1.4 Server-Side Request Forgery via HTTP Redirect
6.5
CVE-2024-52506
Graylog can leak other users' reports via concurrent PDF report rendering