CVE-2026-1436: 
NixOS vulnerability analysis and mitigation

CVE-2026-1436 is an Insecure Direct Object Reference (IDOR) vulnerability in the Graylog API that allows authenticated users to access other users' profiles without proper authorization. The flaw exists in Graylog version 2.2.3, specifically at the /users/<user_id> endpoint (port 12900), where object-level authorization checks are absent. It was published on February 18, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (CIRCL, CVE.org).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), where the Graylog API endpoint http://<IP>:12900/users/<my_user> accepts a user-controlled identifier in the URL path without validating whether the requesting user is authorized to access the specified resource. An authenticated attacker can simply substitute another user's identifier in the URL to retrieve that user's profile data. No elevated privileges are required beyond a valid authenticated session, and exploitation requires no user interaction or complex conditions (CIRCL, CVE.org).

Successful exploitation allows any authenticated Graylog user to enumerate all valid system users and access sensitive profile information belonging to other accounts, including names, email addresses, internal identifiers, and last activity timestamps. The impact is limited to confidentiality — there is no integrity or availability impact — but the exposed data could facilitate targeted phishing, account enumeration, or reconnaissance for further attacks within the organization. The scope is unchanged, meaning the impact is confined to the Graylog application itself (CIRCL).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2026-1436. The EPSS score is approximately 0.028% (0.000280), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a low-privileged authenticated account, making it accessible to any internal or compromised user (CIRCL, CVE.org).

1. Authenticate: Obtain valid credentials for any Graylog account (even a low-privileged user account suffices).
2. Identify the API endpoint: Locate the user profile API endpoint at http://<target_IP>:12900/users/<username_or_id>.
3. Enumerate users: Modify the username or user ID parameter in the URL to iterate through known or guessed usernames/IDs (e.g., replace my_user with other usernames or numeric IDs).
4. Retrieve profile data: For each valid user identifier, the API returns profile information including name, email address, internal identifiers, and last activity — without triggering an authorization error.
5. Compile user list: Aggregate the returned data to build a complete list of valid system users and their sensitive attributes for use in further attacks such as phishing or credential stuffing (CIRCL).

• Network: Repeated HTTP GET requests to http://<IP>:12900/users/<varying_user_ids> from a single authenticated session, especially with sequential or enumerated user identifiers.
• Logs: Graylog API access logs showing a single user account querying the /users/ endpoint for multiple different user IDs in a short time window.
• Behavior: Unusual access patterns where a low-privileged user account generates a high volume of requests to the user profile API endpoint beyond normal self-service activity.

The vulnerability is confirmed in Graylog version 2.2.3; users should upgrade to a newer, patched version of Graylog that implements proper object-level authorization on the /users/ API endpoint. As a workaround, restrict network access to the Graylog API port (12900) using firewall rules to limit exposure to trusted hosts only. Additionally, review and enforce the principle of least privilege for all Graylog user accounts to reduce the risk of exploitation by compromised credentials (CIRCL, CVE.org).