{"action":"Upgrade org.graylog2:graylog2-server to 6.3.12 (6.3.x), 7.0.7 (7.0.x) or 7.1.2 (7.1.x) or later.","affected":[{"fixed":"6.3.12","introduced":"6.2.0"},{"fixed":"7.0.7","introduced":"7.0.0"},{"fixed":"7.1.2","introduced":"7.1.0"}],"component":"org.graylog2:graylog2-server","cve_ids":["CVE-2026-55867"],"ecosystem":"Maven","epss":0.00565,"exploited":false,"fixed_versions":["6.3.12","7.0.7","7.1.2"],"ghsa_id":"GHSA-j769-9gv9-65gr","id":"tcs_01M5N926SJ1Z9X9HRDYMTY36E6","modified_at":"2026-08-28T22:40:41.814627Z","published_at":"2026-08-28T22:15:41Z","references":["https://osv.dev/vulnerability/GHSA-j769-9gv9-65gr","https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-j769-9gv9-65gr","https://github.com/Graylog2/graylog2-server/pull/26049","https://github.com/Graylog2/graylog2-server/pull/26051","https://github.com/Graylog2/graylog2-server/pull/26053","https://github.com/Graylog2/graylog2-server/pull/26055","https://github.com/Graylog2/graylog2-server/commit/41d3745d0e52736d06c07d279ca0d72c1616df4c","https://github.com/Graylog2/graylog2-server/commit/4f280138b53dc3bbb5749213e8cb1c8e372f23a2","https://github.com/Graylog2/graylog2-server/commit/84b0ffa0bdf918f6edd2bb23a47254088634b1fc","https://github.com/Graylog2/graylog2-server/commit/e5accc5f4ce48bd61b84bb8e5a13d21f8eac3da5","https://github.com/Graylog2/graylog2-server"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-j769-9gv9-65gr","url":"https://osv.dev/vulnerability/GHSA-j769-9gv9-65gr"},{"source":"nvd","source_id":"CVE-2026-55867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55867"}],"summary":"Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens"}