CVE-2026-55425Medium· 5.0▾ SunlitGraylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleSe…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request composite display fields without verifying that every selected field is readable. A user can retrieve protected values, including the password hash on a readable user record; ordinary users are limited to their own permitted records, while administrators can retrieve hashes for all users. This issue is fixed in versions 7.1.4 and 7.2.0-alpha.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.graylog2:graylog2-server >= 7.1.0, <= 7.1.3Patched in:
org.graylog2:graylog2-server 7.1.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-69190Medium· 6.3Graylog is a free and open log management platform
CVE-2026-55841High· 7.5Graylog is a free and open log management platform
CVE-2026-55867MediumGraylog is a free and open log management platform
CVE-2026-92789Medium· 6.5Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects
CVE-2026-33216High· 8.6NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system