CVE-2026-55425

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55425

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55425.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55425

Aliases

GHSA-q79r-r9xg-r863

Published

2026-08-28T18:08:22Z

Modified

2026-09-11T08:26:28Z

Severity

5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVSS Calculator

Summary

Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields

Details

Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request composite display fields without verifying that every selected field is readable. A user can retrieve protected values, including the password hash on a readable user record; ordinary users are limited to their own permitted records, while administrators can retrieve hashes for all users. This issue is fixed in versions 7.1.4 and 7.2.0-alpha.2.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-213"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55425.json"
}

References

Affected packages

Git / github.com/graylog2/graylog2-server

Affected ranges

Type

GIT

Repo

https://github.com/graylog2/graylog2-server

Events

Introduced

549ae7f6d53c3736491674c8e1214d2d88e990a2

Introduced

69349fc6453def1f5b7263b2e5f83c035fcbcf45

Fixed

09a50652ae55181358cd53372b5a58ef872d451e

Fixed

2490bd823fb47e613b15ae64ff863996f3bce978

Fixed

1d1a91d99c3d2d8993e61c3c52344648163d3a21

Fixed

da7767a44233b6a683d0713eed08da31ce0e77b5

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "7.1.0"
        },
        {
            "fixed": "7.1.4"
        },
        {
            "introduced": "7.2.0-alpha.1"
        },
        {
            "fixed": "7.2.0-alpha.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

7.*

7.1.0

7.1.1

7.1.2

7.1.3

7.2.0-alpha.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55425.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "3479052352202857256996746373838171155",
                "245446157779742326649552148479262967462",
                "87679750187132738031584207014560198944",
                "63649483392051268907394498481028423889",
                "270935253397900341403104378801447462858",
                "335705491568586460945924426579560627443",
                "140845786348714829140553533596180844742",
                "323369689751392983187149932962016785130",
                "109834418999446743567984536627977930526",
                "199859651157347070733574841657179523292",
                "248640615235482446490172947419068408266",
                "101683274093188008429788723242074844380",
                "198999021854734410559371620827968398474",
                "199865784333430033442480164585145177129",
                "68249858884972879210421707013330966270",
                "222997803165047329200187756648005367270"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55425-11709dc1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5",
        "target": {
            "file": "graylog2-server/src/test/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceMongoTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "216336238613689424930595081335071587105",
                "126847522694148917648904259369087177651",
                "334685167679705255468003683554237921132"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55425-1c071b4b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5",
        "target": {
            "file": "graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/TestSearchUser.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "245454279256059703495619961995908190951",
            "length": 84
        },
        "id": "CVE-2026-55425-242b0b17",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5",
        "target": {
            "file": "graylog2-server/src/test/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceTest.java",
            "function": "setUp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "233497839073929648135927726096289036522",
            "length": 2458
        },
        "id": "CVE-2026-55425-49f3d7f0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5",
        "target": {
            "file": "graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java",
            "function": "getTitlesForEntitiesFromSingleCollection"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "7283675089878198888444541411603804681",
                "305390451635045314709135785259223364666",
                "326525855710822185021945094647875000616",
                "30797388370705136393749796756021061539",
                "338040634464552975200270658364414052056",
                "258689263516138002944917973104289367769",
                "92379079661699153312123366849070301950",
                "318443935356377307284498207996883306846",
                "66162230955304166365478153009514589482",
                "233052847100769589096908218804810864151",
                "278017699349490321152409122863225827760",
                "265696346906745787497272495747742402772",
                "173949082521626622601518464897861094911",
                "212298209253988698916685944804035295825",
                "66391760239792646478589475266271324349",
                "324763887390985226744751728181637016152",
                "314932987783651097281477732468112844014",
                "283604350171576088500506232238649523461"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55425-5baa520d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21",
        "target": {
            "file": "graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "7283675089878198888444541411603804681",
                "305390451635045314709135785259223364666",
                "326525855710822185021945094647875000616",
                "30797388370705136393749796756021061539",
                "338040634464552975200270658364414052056",
                "258689263516138002944917973104289367769",
                "92379079661699153312123366849070301950",
                "318443935356377307284498207996883306846",
                "66162230955304166365478153009514589482",
                "233052847100769589096908218804810864151",
                "278017699349490321152409122863225827760",
                "265696346906745787497272495747742402772",
                "173949082521626622601518464897861094911",
                "212298209253988698916685944804035295825",
                "66391760239792646478589475266271324349",
                "324763887390985226744751728181637016152",
                "314932987783651097281477732468112844014",
                "283604350171576088500506232238649523461"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55425-5fbf9d3c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5",
        "target": {
            "file": "graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "200767409749945173084722988955821751404",
            "length": 100
        },
        "id": "CVE-2026-55425-6173127c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21",
        "target": {
            "file": "graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java",
            "function": "EntityTitleServiceImpl"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "119641773520411186903703355535916462989",
            "length": 424
        },
        "id": "CVE-2026-55425-61ed78ae",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21",
        "target": {
            "file": "graylog2-server/src/test/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceMongoTest.java",
            "function": "setUp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "233497839073929648135927726096289036522",
            "length": 2458
        },
        "id": "CVE-2026-55425-7ffadf77",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21",
        "target": {
            "file": "graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java",
            "function": "getTitlesForEntitiesFromSingleCollection"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "3479052352202857256996746373838171155",
                "245446157779742326649552148479262967462",
                "87679750187132738031584207014560198944",
                "63649483392051268907394498481028423889",
                "276195075858661762048223475291339580347",
                "251629232698171993868103533170727923782",
                "317760380110393167014972006880606607451",
                "55773605084529942427600948681834895599"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55425-b417dc72",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5",
        "target": {
            "file": "graylog2-server/src/test/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "245454279256059703495619961995908190951",
            "length": 84
        },
        "id": "CVE-2026-55425-cad2e84a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21",
        "target": {
            "file": "graylog2-server/src/test/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceTest.java",
            "function": "setUp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "3479052352202857256996746373838171155",
                "245446157779742326649552148479262967462",
                "87679750187132738031584207014560198944",
                "63649483392051268907394498481028423889",
                "276195075858661762048223475291339580347",
                "251629232698171993868103533170727923782",
                "317760380110393167014972006880606607451",
                "55773605084529942427600948681834895599"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55425-cc644412",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21",
        "target": {
            "file": "graylog2-server/src/test/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "216336238613689424930595081335071587105",
                "126847522694148917648904259369087177651",
                "334685167679705255468003683554237921132"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55425-d920f437",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21",
        "target": {
            "file": "graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/TestSearchUser.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "119641773520411186903703355535916462989",
            "length": 424
        },
        "id": "CVE-2026-55425-dabc258b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5",
        "target": {
            "file": "graylog2-server/src/test/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceMongoTest.java",
            "function": "setUp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "3479052352202857256996746373838171155",
                "245446157779742326649552148479262967462",
                "87679750187132738031584207014560198944",
                "63649483392051268907394498481028423889",
                "270935253397900341403104378801447462858",
                "335705491568586460945924426579560627443",
                "140845786348714829140553533596180844742",
                "323369689751392983187149932962016785130",
                "109834418999446743567984536627977930526",
                "199859651157347070733574841657179523292",
                "248640615235482446490172947419068408266",
                "101683274093188008429788723242074844380",
                "198999021854734410559371620827968398474",
                "199865784333430033442480164585145177129",
                "68249858884972879210421707013330966270",
                "222997803165047329200187756648005367270"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55425-f55d87c7",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21",
        "target": {
            "file": "graylog2-server/src/test/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceMongoTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "200767409749945173084722988955821751404",
            "length": 100
        },
        "id": "CVE-2026-55425-fcc1227d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5",
        "target": {
            "file": "graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java",
            "function": "EntityTitleServiceImpl"
        }
    }
]

vanir_signatures_modified

"2026-09-11T08:26:28Z"