CVE-2026-69190: 
Java vulnerability analysis and mitigation

CVE-2026-69190 is a privilege escalation vulnerability in Graylog's view update API that allows a user with edit permissions (but without entity ownership) to grant owner-level permissions to an arbitrary account on saved searches and dashboards. Affected versions include graylog2-server 6.3.0 through 6.3.13, 7.0.0 through 7.0.8, and 7.1.0 through 7.1.3. The vulnerability was published on September 21, 2026, and carries a CVSS v3.1 base score of 6.3 (Medium) (GitHub Advisory). Graylog Cloud was patched prior to the advisory's publication.

The root cause is a missing authorization check (CWE-862) combined with an authorization bypass through a user-controlled key (CWE-639) in the ViewsResource.java REST endpoint (/views/{id}). When a user submits a view update request containing a shareRequest body parameter, the API previously did not verify whether the requesting user owned the entity before applying the sharing change — only edit permission was checked. This allowed a non-owner editor to craft an update request with a shareRequest that elevated an arbitrary account to owner, effectively hijacking ownership. The fix, introduced in PR #26344, adds an ownership check (checkOwnership()) before processing any shareRequest in the update path, returning HTTP 403 Forbidden to non-owners (GitHub Advisory, Fix PR).

A successful exploit allows a low-privileged authenticated user to escalate their effective control over saved searches and dashboards they can edit but do not own. The attacker-controlled account, once granted owner permissions, can delete the affected saved search or dashboard, or revoke the original owner's access entirely. This results in limited confidentiality impact (access to shared log query configurations), low integrity impact (modification or deletion of dashboards/searches), and low availability impact (loss of access to monitoring resources for legitimate owners) (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory date. The vulnerability requires a valid low-privileged account with edit access to at least one saved search or dashboard, making it non-automatable and requiring some degree of insider access or compromised credentials. The EPSS score is approximately 0.0024 (0.24%), indicating low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Authenticate: Log in to a vulnerable Graylog instance (versions 6.3.0–6.3.13, 7.0.0–7.0.8, or 7.1.0–7.1.3) using a low-privileged account that has edit (but not owner) permissions on at least one saved search or dashboard.
2. Identify target entity: Enumerate accessible saved searches or dashboards via the Graylog API (e.g., GET /api/views) to obtain the target entity's ID.
3. Craft malicious update request: Construct a PUT request to /api/views/{id} that includes the normal view update body plus a shareRequest field granting owner-level permissions to an attacker-controlled account.
4. Submit the request: Send the crafted request. On unpatched versions, the API applies the sharing change without verifying entity ownership, elevating the attacker-controlled account to owner.
5. Abuse elevated privileges: Using the newly granted owner account, delete the saved search or dashboard, or remove the original owner's access to disrupt monitoring operations (GitHub Advisory, Fix PR).

• Logs: Graylog API access logs showing PUT requests to /api/views/{id} from users who are not the entity owner, particularly requests containing a shareRequest body parameter; unexpected ownership changes recorded in Graylog audit logs.
• Application Behavior: Saved searches or dashboards with unexpected ownership changes or sudden loss of access by the original owner; accounts unexpectedly appearing as owners of entities they did not create.
• Network: Repeated or scripted PUT requests to /api/views/ endpoints from a single low-privileged user account, especially if followed by DELETE requests to the same entities.

Upgrade graylog2-server to one of the patched versions: 6.3.14, 7.0.9, or 7.1.4. There is no known workaround — the vendor explicitly states that upgrading to a patched version is the only remediation. Graylog Cloud was already patched before the advisory was published. Organizations should prioritize upgrading any on-premises deployments running affected versions (GitHub Advisory).

The vulnerability was reported by Jan Kahmen of turingpoint and credited in the official GitHub Security Advisory. No significant broader media coverage or notable researcher commentary beyond the advisory and associated GitHub pull request discussion has been identified at this time (GitHub Advisory).