Vulnerability-Lookup

CVE-2026-55425 (GCVE-0-2026-55425)

Vulnerability from cvelistv5 – Published: 2026-08-28 18:08 – Updated: 2026-08-28 18:08

Title

Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields

Summary

Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request composite display fields without verifying that every selected field is readable. A user can retrieve protected values, including the password hash on a readable user record; ordinary users are limited to their own permitted records, while administrators can retrieve hashes for all users. This issue is fixed in versions 7.1.4 and 7.2.0-alpha.2.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

CWE

CWE-213 - Exposure of Sensitive Information Due to Incompatible Policies

Assigner

GitHub_M mitre root

References

6 references

URL	Tags
https://github.com/Graylog2/graylog2-server/secur…	x_refsource_CONFIRM
https://github.com/Graylog2/graylog2-server/pull/26284	x_refsource_MISC
https://github.com/Graylog2/graylog2-server/commi…	x_refsource_MISC
https://github.com/Graylog2/graylog2-server/commi…	x_refsource_MISC
https://github.com/Graylog2/graylog2-server/relea…	x_refsource_MISC
https://github.com/Graylog2/graylog2-server/relea…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
Graylog2	graylog2-server	Affected: >= 7.1.0, < 7.1.4 Affected: >= 7.2.0-alpha.1, < 7.2.0-alpha.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "graylog2-server",
          "vendor": "Graylog2",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.1.0, \u003c 7.1.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.2.0-alpha.1, \u003c 7.2.0-alpha.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request composite display fields without verifying that every selected field is readable. A user can retrieve protected values, including the password hash on a readable user record; ordinary users are limited to their own permitted records, while administrators can retrieve hashes for all users. This issue is fixed in versions 7.1.4 and 7.2.0-alpha.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-213",
              "description": "CWE-213: Exposure of Sensitive Information Due to Incompatible Policies",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T18:08:22.113Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-q79r-r9xg-r863",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-q79r-r9xg-r863"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/pull/26284",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/pull/26284"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/releases/tag/7.1.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/releases/tag/7.1.4"
        },
        {
          "name": "https://github.com/Graylog2/graylog2-server/releases/tag/7.2.0-alpha.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Graylog2/graylog2-server/releases/tag/7.2.0-alpha.2"
        }
      ],
      "source": {
        "advisory": "GHSA-q79r-r9xg-r863",
        "discovery": "UNKNOWN"
      },
      "title": "Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55425",
    "datePublished": "2026-08-28T18:08:22.113Z",
    "dateReserved": "2026-06-16T21:48:43.126Z",
    "dateUpdated": "2026-08-28T18:08:22.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55425",
      "date": "2026-08-30",
      "epss": "0.00302",
      "percentile": "0.22407"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-55425\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-28T20:18:27.360\",\"lastModified\":\"2026-08-28T20:18:27.360\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request composite display fields without verifying that every selected field is readable. A user can retrieve protected values, including the password hash on a readable user record; ordinary users are limited to their own permitted records, while administrators can retrieve hashes for all users. This issue is fixed in versions 7.1.4 and 7.2.0-alpha.2.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"Graylog2\",\"product\":\"graylog2-server\",\"versions\":[{\"version\":\"\u003e= 7.1.0, \u003c 7.1.4\",\"status\":\"affected\"},{\"version\":\"\u003e= 7.2.0-alpha.1, \u003c 7.2.0-alpha.2\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N\",\"baseScore\":5.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.1,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-213\"}]}],\"references\":[{\"url\":\"https://github.com/Graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Graylog2/graylog2-server/pull/26284\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Graylog2/graylog2-server/releases/tag/7.1.4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Graylog2/graylog2-server/releases/tag/7.2.0-alpha.2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-q79r-r9xg-r863\",\"source\":\"security-advisories@github.com\"}]}}"
  }
}

FKIE_CVE-2026-55425

Vulnerability from fkie_nvd - Published: 2026-08-28 20:18 - Updated: 2026-08-28 20:18

Severity

5.0 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/pull/26284
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/releases/tag/7.1.4
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/releases/tag/7.2.0-alpha.2
	security-advisories@github.com	https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-q79r-r9xg-r863

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "graylog2-server",
          "vendor": "Graylog2",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.1.0, \u003c 7.1.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.2.0-alpha.1, \u003c 7.2.0-alpha.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request composite display fields without verifying that every selected field is readable. A user can retrieve protected values, including the password hash on a readable user record; ordinary users are limited to their own permitted records, while administrators can retrieve hashes for all users. This issue is fixed in versions 7.1.4 and 7.2.0-alpha.2."
    }
  ],
  "id": "CVE-2026-55425",
  "lastModified": "2026-08-28T20:18:27.360",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-28T20:18:27.360",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/pull/26284"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/releases/tag/7.1.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/releases/tag/7.2.0-alpha.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-q79r-r9xg-r863"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-213"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-Q79R-R9XG-R863

Vulnerability from github – Published: 2026-08-28 18:09 – Updated: 2026-08-28 18:09

Summary

Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields

Details

Impact

A vulnerability was found in Graylog's API endpoint for retrieving system catalog entity titles. Authenticated users could retrieve database fields of supported entities by sending a custom API request. These fields can include e.g. the password hash of a user (but not the password itself), which should not be returned through the API, regardless of the endpoint. Permission checks do still apply, so users can retrieve their own password hash, but not those of other users. The admin user (or any user with an admin role) can retrieve password hashes of all users.

Patches

This issue has been patched in Graylog 7.1.4. In this version, an allow list will be used to check if protected fields are being accessed, refusing those requests. Affected users should upgrade to 7.1.4 or above to remediate the vulnerability.

Workarounds

There is no known workaround. Upgrading to a patched version is recommended.

Credits

Thanks to Evelynkaz for reporting.

Severity

5.0 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.1.3"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.graylog2:graylog2-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.1.0"
            },
            {
              "fixed": "7.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55425"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-213"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T18:09:29Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nA vulnerability was found in Graylog\u0027s API endpoint for retrieving system catalog entity titles. Authenticated users could retrieve database fields of supported entities by sending a custom API request. These fields can include e.g. the password hash of a user (but not the password itself), which should not be returned through the API, regardless of the endpoint. Permission checks do still apply, so users can retrieve their own password hash, but not those of other users. The admin user (or any user with an admin role) can retrieve password hashes of all users.\n\n### Patches\n\nThis issue has been patched in Graylog `7.1.4`. In this version, an allow list will be used to check if protected fields are being accessed, refusing those requests. Affected users should upgrade to `7.1.4` or above to remediate the vulnerability.\n\n### Workarounds\n\nThere is no known workaround. Upgrading to a patched version is recommended.\n\n### Credits\n\nThanks to [Evelynkaz](https://github.com/Evelynkaz) for reporting.",
  "id": "GHSA-q79r-r9xg-r863",
  "modified": "2026-08-28T18:09:29Z",
  "published": "2026-08-28T18:09:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-q79r-r9xg-r863"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/pull/26284"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Graylog2/graylog2-server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/releases/tag/7.1.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/releases/tag/7.2.0-alpha.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-55425 (GCVE-0-2026-55425)

FKIE_CVE-2026-55425

GHSA-Q79R-R9XG-R863

Impact

Patches

Workarounds

Credits

Tags

Sightings

Nomenclature