CVE-2026-65011

MEDIUM 4.3

Graylog2 Server Missing Permission Check on Event Definition Duplicate

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/{definitionId}/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private event definitions including detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings by duplicating them.

CWE	CWE-862
Vendor	graylog2
Product	graylog2-server
Published	Jul 22, 2026

Stay Ahead of the Next One

Get instant alerts for graylog2 graylog2-server

Be the first to know when new medium vulnerabilities affecting graylog2 graylog2-server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

Graylog2 / graylog2-server

0 ≤ 7.1.5 0 ≤ 7.0.10

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Graylog2/graylog2-server/issues/26590 github.com: https://github.com/Graylog2/graylog2-server/pull/26706 github.com: https://github.com/Graylog2/graylog2-server/commit/46a2eeba4cdbc1408ff4cbf7b466853a8acfb38d github.com: https://github.com/Graylog2/graylog2-server/pull/26718 github.com: https://github.com/Graylog2/graylog2-server/pull/26719 vulncheck.com: https://www.vulncheck.com/advisories/graylog2-server-missing-permission-check-on-event-definition-duplicate

Credits

George Chen