CVE-2026-69190

Name of the Vulnerable Software and Affected Versions Graylog versions 6.3.0 through 6.3.13 Graylog versions 7.0.x prior to 7.0.9 Graylog versions 7.1.x prior to 7.1.4

Description The view update API for saved searches and dashboards allows a user with edit permissions, who is not the entity owner, to include a shareRequest that grants owner permissions to an arbitrary account. This can enable the selected account to delete the saved search or dashboard or revoke the original owner's access.

Recommendations Update Graylog to version 6.3.14. Update Graylog to version 7.0.9. Update Graylog to version 7.1.4.