CVE-2026-55867

Received Received - Intake

Unauthorized Token Deletion in Graylog

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId}/tokens/{idOrToken} endpoint implemented by UsersResource.revokeToken() in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERS_TOKENREMOVE permission against the attacker-controlled userId path parameter before resolving the token selected by idOrToken. An authenticated user can provide an authorized userId while accessTokenService.loadById() or accessTokenService.load() resolves a token belonging to another user, including a service account or administrator, after which accessTokenService.destroy() deletes that token without checking AccessToken.getUserName(). The issue does not expose token contents, but unauthorized deletion causes integrity impact and can disrupt access-token-based integrations. This issue is fixed in versions 6.3.12, 7.0.7, and 7.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55867

Affected Vendors & Products

Vendor	Product	Version / Range
graylog	graylog	From 6.2.0 (inc) to 6.3.12 (inc)
graylog	graylog	7.0.7
graylog	graylog	7.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in Graylog allows an authenticated user to delete tokens belonging to other users, including administrators or service accounts, by manipulating the userId parameter. The endpoint checks permissions against the attacker-controlled userId before verifying token ownership, enabling unauthorized deletion of tokens without exposing their contents.

Impact Analysis

An attacker could disrupt access-token-based integrations by deleting tokens, causing loss of functionality for services relying on those tokens. While token contents aren't exposed, unauthorized deletion can lead to service disruptions and potential integrity issues for affected accounts.

Compliance Impact

This vulnerability allows unauthorized deletion of access tokens, which could disrupt authentication mechanisms and lead to unauthorized access or denial of service. For GDPR, this may impact data integrity and availability, potentially violating Article 32 security requirements. For HIPAA, it could compromise access controls and audit mechanisms, affecting integrity and availability of protected health information.

Mitigation Strategies

Upgrade Graylog to a patched version (6.3.12, 7.0.7, or 7.1.2 or later) to resolve the vulnerability. Ensure all users with access to the DELETE /users/{userId}/tokens/{idOrToken} endpoint are authenticated and authorized.

Hi! I’m here to help you understand CVE-2026-55867. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70