---
id: CVE-2026-69190
title: Graylog is a free and open log management platform
summary: >-
  Graylog is a free and open log management platform. From 6.3.0 until 6.3.14,
  7.0.9, and 7.1.4, the view update API for saved searches and dashboards
  permits a user with edit permission but without entity ownership to include a
  shareReque…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-639
  - CWE-862
vendor: Graylog2
product: graylog2-server
affected:
  - 'graylog2-server >= 6.3.0, < 6.3.14'
  - 'graylog2-server >= 7.0.0, < 7.0.9'
  - 'graylog2-server >= 7.1.0, < 7.1.4'
patched:
  - 'org.graylog2:graylog2-server 6.3.14'
  - 'org.graylog2:graylog2-server 7.0.9'
  - 'org.graylog2:graylog2-server 7.1.4'
published: '2026-09-21'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:17:43.237'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69190'
references:
  - url: >-
      https://github.com/Graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4
    label: security-advisories@github.com
  - url: >-
      https://github.com/Graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2
    label: security-advisories@github.com
  - url: >-
      https://github.com/Graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608
    label: security-advisories@github.com
  - url: >-
      https://github.com/Graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42
    label: security-advisories@github.com
  - url: 'https://github.com/Graylog2/graylog2-server/pull/26344'
    label: security-advisories@github.com
  - url: 'https://github.com/Graylog2/graylog2-server/releases/tag/6.3.14'
    label: security-advisories@github.com
  - url: 'https://github.com/Graylog2/graylog2-server/releases/tag/7.0.9'
    label: security-advisories@github.com
  - url: 'https://github.com/Graylog2/graylog2-server/releases/tag/7.1.4'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-m9c2-85gv-8xr5
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69190'
  - url: 'https://github.com/advisories/GHSA-m9c2-85gv-8xr5'
tags:
  - nvd
  - cve.org
  - ghsa
  - maven
epss: 0.00423
epssPercentile: 0.33853
aliases:
  - GHSA-m9c2-85gv-8xr5
ecosystem: maven
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T19:01:52.176197Z'
ingestedAt: '2026-09-21T18:50:57.565Z'
---

## Overview

Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-69190)

Affected packages:

- `org.graylog2:graylog2-server >= 6.3.0, < 6.3.14`
- `org.graylog2:graylog2-server >= 7.0.0, < 7.0.9`
- `org.graylog2:graylog2-server >= 7.1.0, < 7.1.4`

Patched in:

- `org.graylog2:graylog2-server 6.3.14`
- `org.graylog2:graylog2-server 7.0.9`
- `org.graylog2:graylog2-server 7.1.4`

Source: https://github.com/advisories/GHSA-m9c2-85gv-8xr5