CVE-2026-69190

Executive Summary

CVE-2026-69190 is an authorization bypass vulnerability in Graylog, a free and open-source log management platform. The flaw resides in the view update API for saved searches and dashboards, allowing a user with edit permissions but without entity ownership to include a shareRequest parameter that grants owner permissions to an arbitrary account. This enables privilege escalation within the Graylog instance, permitting the selected account to delete saved searches or dashboards or remove the original owner's access. The vulnerability affects Graylog versions from 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, with a CVSS score of 6.3 (Medium severity).

Technical Analysis

CVE-2026-69190 is classified as CWE-639: Authorization Bypass Through User-Controlled Key. The vulnerability exists in the view update API endpoint responsible for managing saved searches and dashboards within Graylog. The core issue is a broken access control mechanism where the API permits a user with edit permissions—but lacking ownership of the entity—to manipulate the shareRequest parameter. This parameter is intended to control sharing permissions for the view (saved search or dashboard). By crafting a malicious shareRequest, an attacker can grant owner-level permissions to an arbitrary account of their choosing.

The attack surface is the Graylog web API, specifically the view update functionality. The vulnerability requires the attacker to have valid credentials with edit permissions on the target view, but not ownership. The shareRequest parameter, when processed by the API, fails to validate whether the requesting user has the authority to grant ownership permissions. This allows privilege escalation: the attacker can add a controlled account as an owner, which then possesses full control over the view, including deletion or modification of access controls for the original owner.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates network exploitable, low complexity, low privileges required, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability. The low confidentiality impact arises from potential information disclosure through modified views, the low integrity impact from unauthorized modifications, and the low availability impact from deletion of views.

Exploitation Scenarios

1. Reconnaissance/Target Identification: The attacker identifies a Graylog instance (version 6.3.0–6.3.13, 7.0.0–7.0.8, or 7.1.0–7.1.3) exposed to the network. They must possess valid credentials with edit permissions on at least one saved search or dashboard but not ownership. This could be obtained through legitimate low-privilege access or credential compromise.

2. Triggering the Flaw: The attacker sends a crafted request to the view update API endpoint. The request includes a shareRequest parameter that specifies an arbitrary account (controlled by the attacker) to be granted owner permissions. The API fails to verify that the requesting user has the authority to grant ownership, processing the request and updating the sharing permissions accordingly.

3. Payload/Execution Method: The attack is executed via a standard HTTP request to the Graylog API. The payload is a JSON or form-encoded body containing the malicious shareRequest. No specialized exploit code is required; the attacker can use tools like curl or a scripting language to send the request. The vulnerability class is authorization bypass through user-controlled key manipulation, and the attack relies on the API's improper access control logic.

4. Post-Exploitation Impact: The arbitrary account now has owner permissions on the saved search or dashboard. The attacker can use this account to delete the view, modify its contents, or remove the original owner's access. This could disrupt monitoring, hide malicious activity by tampering with dashboards, or cause data loss. The impact is limited to the affected view, but in a log management platform, such tampering could obscure security events or operational metrics.

No public PoC is available; the attack chain is inferred from the vulnerability class and description.

Impact Assessment

The business impact of CVE-2026-69190 is moderate. Affected systems are Graylog instances running vulnerable versions (6.3.0–6.3.13, 7.0.0–7.0.8, 7.1.0–7.1.3). The blast radius is limited to saved searches and dashboards within the Graylog environment. An attacker with low privileges can escalate their access to owner level for specific views, leading to unauthorized modifications, data integrity issues, and potential loss of critical monitoring dashboards. The CVSS subscores reflect low impact across confidentiality, integrity, and availability (C:L/I:L/A:L), as the scope is unchanged and the vulnerability does not allow full system compromise. However, in security operations, the ability to tamper with dashboards could hide indicators of compromise or disrupt incident response.

Detection Guidance

Sigma Rule

title: Graylog View Update API ShareRequest Privilege Escalation
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects exploitation attempts of CVE-2026-69190 via unauthorized shareRequest in view update API
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: graylog
detection:
  selection:
    http.method: 'PUT'
    http.url|contains: '/api/views/'
    http.url|endswith: '/share'
    http.request.body|contains: 'shareRequest'
  condition: selection
falsepositives:
  - Legitimate administrative actions
level: high

YARA Rule

rule CVE_2026_69190_Graylog_ShareRequest
{
    meta:
        description = "Detects exploitation attempts of CVE-2026-69190 in Graylog view update API"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-69190"
        severity = "medium"
    strings:
        $s1 = "shareRequest" ascii wide nocase
        $s2 = "/api/views/" ascii wide nocase
        $s3 = "owner" ascii wide nocase
        $s4 = "grant" ascii wide nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-69190 Graylog View Update API ShareRequest Privilege Escalation Attempt"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:"/api/views/"; http.uri; content:"/share"; http.request_body; content:"shareRequest"; classtype:attempted-admin; sid:1000001; rev:1;)

Elastic Detection

sequence by user.name
  [http where http.request.method == "PUT" and http.request.uri : "/api/views/*/share" and http.request.body : "shareRequest"]

Splunk SPL Query

index=web sourcetype=graylog_access
| search method=PUT uri_path="/api/views/*/share" body=*shareRequest*
| stats count by src_ip, user, uri_path
| where count > 0

Wazuh OSSEC Rule

<group name="graylog,">
  <rule id="100001" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.method">PUT</field>
    <field name="http.url">/api/views/.*/share</field>
    <field name="http.request.body">shareRequest</field>
    <description>CVE-2026-69190: Graylog view update API shareRequest privilege escalation attempt</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict network access to the Graylog API to trusted IP ranges.
   • Audit user permissions and enforce least privilege; remove edit permissions from users who do not require them.
   • Monitor API logs for suspicious shareRequest parameters or unexpected ownership changes.

2. Patch/Upgrade Steps:

   • Upgrade to Graylog 6.3.14, 7.0.9, or 7.1.4 once available. Graylog Cloud has already been patched.
   • If immediate upgrade is not possible, consider disabling the view update API for non-owner users via reverse proxy rules or custom middleware.

3. Long-term Hardening:

   • Implement strict access control checks in the API to validate that only owners can grant ownership.
   • Conduct regular security reviews of API endpoints for authorization flaws.
   • Enable comprehensive logging and alerting for permission changes.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-69190
• Graylog Security Advisory: (vendor advisory pending publication)
• CWE-639: https://cwe.mitre.org/data/definitions/639.html
• CISA KEV: Not listed
• No known threat actor campaigns or exploit-in-the-wild evidence at this time.