CVE-2026-65011

Name of the Vulnerable Software and Affected Versions Graylog2 Server versions prior to commit 46a2eeb

Description An issue exists where a per-entity permission check is missing in the 'POST /events/definitions/{definitionId}/duplicate' endpoint. This allows authenticated users with the eventdefinitions:create capability to clone any event definition. By duplicating these definitions, attackers can read private information, including detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings.

Recommendations Update Graylog2 Server to commit 46a2eeb or a later version. Restrict the use of the eventdefinitions:create capability to trusted users until the update is applied.