CVE-2026-55425

Received Received - Intake

Information Disclosure in Graylog System Catalog

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request composite display fields without verifying that every selected field is readable. A user can retrieve protected values, including the password hash on a readable user record; ordinary users are limited to their own permitted records, while administrators can retrieve hashes for all users. This issue is fixed in versions 7.1.4 and 7.2.0-alpha.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55425

EUVD

EUVD-2026-67856

Affected Vendors & Products

Vendor	Product	Version / Range
graylog	graylog	to 7.1.4 (inc)
graylog	graylog	to 7.2.0-alpha.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-213	The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.

Attack-Flow Graph

Executive Summary

This vulnerability in Graylog allows authenticated users to access protected database fields, including user password hashes, through the System Catalog entity titles endpoint. The issue occurs when composite display fields are requested without verifying read permissions for each field. Ordinary users can only access their own records, while administrators can retrieve hashes for all users. The flaw was fixed in versions 7.1.4 and 7.2.0-alpha.2.

Detection Guidance

To detect this vulnerability, check if your Graylog server version is between 7.1.0 and 7.1.3 or 7.2.0-alpha.2. Use commands like 'curl -X GET http://<graylog-server>/api/system/catalog/entity/titles' to test if sensitive fields like password hashes are exposed. If the response includes protected values, the system is vulnerable.

Impact Analysis

An attacker with authenticated access could exploit this to retrieve password hashes, potentially leading to account compromise. Administrators face higher risk as they can access all user hashes. The vulnerability requires low privileges and has moderate severity, making it a moderate risk for exposed systems.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive personal data such as password hashes. GDPR and HIPAA mandate protection of personal and health information, and such unauthorized access may result in non-compliance, potential fines, and reputational damage.

Mitigation Strategies

Upgrade Graylog to version 7.1.4 or later. If upgrading is not immediately possible, restrict API access to trusted users and monitor for unusual requests to the entity titles endpoint. Apply the patch from the GitHub commit 1d1a91d99c3d2d8993e61c3c52344648163d3a21.

Hi! I’m here to help you understand CVE-2026-55425. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70