Token Deletion Vulnerability in Graylog Log Management Platform
CVE-2026-55867
What is CVE-2026-55867?
A vulnerability in the Graylog log management platform allows authenticated users to exploit the DELETE /users/{userId}/tokens/{idOrToken} endpoint, where the system improperly validates permissions based on an attacker-controlled userId path parameter. This flaw enables malicious users to delete tokens associated with other users, including administrators, which can lead to significant disruptions in access-control measures and integrations reliant on access tokens. The integrity of the system is compromised without exposing any sensitive token contents. The issue has been addressed in subsequent versions, ensuring secure management of user tokens.
Affected Version(s)
graylog2-server >= 6.2.0, < 6.3.12 < 6.2.0, 6.3.12
graylog2-server >= 7.0.0-alpha.1, < 7.0.7 < 7.0.0-alpha.1, 7.0.7
graylog2-server >= 7.1.0-alpha.1, < 7.1.2 < 7.1.0-alpha.1, 7.1.2