CVE-2026-55867
1 advisory.
Maven/org.graylog2:graylog2-server CVE-2026-55867: medium, EPSS 0.56%
Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens
Action: Upgrade org.graylog2:graylog2-server to 6.3.12 (6.3.x), 7.0.7 (7.0.x) or 7.1.2 (7.1.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.2.0 | 6.3.12 | - |
| 7.0.0 | 7.0.7 | - |
| 7.1.0 | 7.1.2 | - |
Fixed versions
| 6.3.12 | 7.0.7 | 7.1.2 |
Sources
- osv: GHSA-j769-9gv9-65gr
- https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-j769-9gv9-65gr
- https://github.com/Graylog2/graylog2-server/pull/26049
- https://github.com/Graylog2/graylog2-server/pull/26051
- https://github.com/Graylog2/graylog2-server/pull/26053
- https://github.com/Graylog2/graylog2-server/pull/26055
- https://github.com/Graylog2/graylog2-server/commit/41d3745d0e52736d06c07d279ca0d72c1616df4c
- https://github.com/Graylog2/graylog2-server/commit/4f280138b53dc3bbb5749213e8cb1c8e372f23a2
- https://github.com/Graylog2/graylog2-server/commit/84b0ffa0bdf918f6edd2bb23a47254088634b1fc
- https://github.com/Graylog2/graylog2-server/commit/e5accc5f4ce48bd61b84bb8e5a13d21f8eac3da5
- https://github.com/Graylog2/graylog2-server
CVE-2026-55867 · published · modified · JSON