CVE-2026-69190

Summary

Users with edit permissions but without entity ownership can exploit a flaw in Graylog to gain full control over saved searches and dashboards, allowing them to delete or modify content.

Exploitability

Exploitation requires an authenticated user with specific permissions; the attacker must have edit access but not entity ownership.

Blast radius

If exploited, this can lead to unauthorized modifications or deletions of critical log data, impacting system integrity and audit trails.

Prioritized remediation

Update Graylog to version 6.3.14, 7.0.9, or 7.1.4 to address the vulnerability.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.