CVE-2026-55867

Name of the Vulnerable Software and Affected Versions Graylog versions prior to 6.3.12 Graylog versions prior to 7.0.7 Graylog versions prior to 7.1.2

Description An insecure direct object reference (IDOR) exists in the token revocation process. An authenticated user can delete access tokens belonging to other users, including service accounts and administrators, by manipulating the userId path parameter in the 'DELETE /users/{userId}/tokens/{idOrToken}' endpoint. The revokeToken() function checks the USERS TOKENREMOVE permission against the attacker-controlled userId before resolving the token via idOrToken. Because the system fails to verify if the resolved token actually belongs to the specified user via AccessToken.getUserName(), the accessTokenService.destroy() function deletes the token regardless of ownership. While token contents are not exposed, this allows unauthorized deletion that disrupts access-token-based integrations.

Recommendations Update to version 6.3.12 or later. Update to version 7.0.7 or later. Update to version 7.1.2 or later.