CVE-2026-55425 json
Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields
published 2026-08-28 2 mo ago modified 2026-09-09 1 mo ago also EUVD-2026-67856 , GHSA-q79r-r9xg-r863
- cvss
- 5.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 35%
- public exploits
- 0
- none known
Summary
Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request composite display fields without verifying that every selected field is readable. A user can retrieve protected values, including the password hash on a readable user record; ordinary users are limited to their own permitted records, while administrators can retrieve hashes for all users. This issue is fixed in versions 7.1.4 and 7.2.0-alpha.2.
Patch / fix
- maven org.graylog2:graylog2-server 7.1.4
- graylog graylog 7.1.4, 7.2.0-alpha.2
- org.graylog2 graylog2-server 7.1.4, 7.2.0-alpha.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
| GitHub | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.graylog2:graylog2-server | >=7.1.0, <7.1.4 |
7.1.4 |
Affected products
- Graylog2 graylog2-server
Classification
- Weakness
-
- CWE-213 Exposure of Sensitive Information Due to Incompatible Policies
References
-
github.com
/Graylog2/graylog2-server/pull/26284
web
-
github.com
/Graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21
web
-
github.com
/Graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5
web
-
github.com
/Graylog2/graylog2-server/security/advisories/GHSA-q79r-r9xg-r863
web
-
github.com
/Graylog2/graylog2-server/releases/tag/7.1.4
web
-
github.com
/Graylog2/graylog2-server/releases/tag/7.2.0-alpha.2
web
-
github.com
/Graylog2/graylog2-server
package
Sources
- CVE List CVE-2026-55425
- GitHub Advisory GHSA-q79r-r9xg-r863
- NVD CVE-2026-55425
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.