CVE-2026-65011

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-65011

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65011.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-65011

Published

2026-07-22T16:13:35.244Z

Modified

2026-07-25T08:12:08.010868Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Graylog2 Server Missing Permission Check on Event Definition Duplicate

Details

Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/{definitionId}/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private event definitions including detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings by duplicating them.

Database specific

{
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65011.json",
    "cwe_ids": [
        "CWE-862"
    ]
}

References

Affected packages

Git / github.com/graylog2/graylog2-server

Affected ranges

Type

GIT

Repo

https://github.com/graylog2/graylog2-server

Events

Introduced

Fixed

46a2eeba4cdbc1408ff4cbf7b466853a8acfb38d

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.1.5"
        },
        {
            "last_affected": "7.0.10"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.10.0

0.10.0-preview.2

0.10.0-rc.1

0.10.0-rc.2

0.10.0-rc.3

0.10.0-rc.4

0.11.0

0.20.0-preview.1

0.20.0-preview.2

0.20.0-preview.3

0.20.0-preview.4

0.20.0-preview.5

0.20.0-preview.6

0.20.0-rc.1

0.20.0-rc.1-1

0.21.0-beta1

0.21.0-beta2

0.21.0-beta3

0.21.0-beta4

0.21.0-rc.1

0.9

0.9.1

0.9.2

0.9.3

0.9.4

0.9.4p1

0.9.5

0.9.5p1

0.9.6

0.9.6-PREVIEW

0.9.6-PREVIEW.2

0.9.6-PREVIEW.3

0.9.6-beta

0.9.7-preview.1

1.*

1.0.0-beta.1

1.1.0-beta.1

1.1.0-beta.2

1.1.0-beta.3

1.1.0-rc.1

1.2.0-rc.1

1.2.0-rc.2

1.2.0-rc.3

1.2.0-rc.4

2.*

2.0.0-alpha.1

2.0.0-alpha.2

2.0.0-alpha.3

2.0.0-alpha.4

2.0.0-alpha.5

2.0.0-beta.1

2.0.0-beta.2

2.0.0-beta.3

2.1.0-alpha.1

2.1.0-alpha.2

2.1.0-beta.1

2.1.0-beta.2

2.1.0-beta.3

2.1.0-beta.4

2.1.0-rc.1

2.2.0

2.2.0-alpha.1

2.2.0-alpha.2

2.2.0-alpha.3

2.2.0-alpha.4

2.2.0-beta.1

2.2.0-beta.2

2.2.0-beta.3

2.2.0-beta.4

2.2.0-beta.5

2.2.0-beta.6

2.2.0-rc.1

2.3.0-alpha.1

2.3.0-alpha.2

2.3.0-alpha.3

2.3.0-beta.1

2.3.0-rc.1

2.4.0-alpha.1

2.4.0-alpha.2

2.4.0-alpha.3

3.*

3.0.0-alpha.0

3.0.0-alpha.1

3.0.0-alpha.2

3.0.0-alpha.3

3.0.0-alpha.4

3.0.0-alpha.5

3.0.0-beta.1

3.1.0

3.1.0-beta.1

3.1.0-beta.2

3.1.0-beta.3

3.1.0-rc.1

3.1.0-rc.2

3.2.0-beta.1

3.2.0-beta.2

3.2.0-beta.3

3.2.0-beta.4

3.2.0-rc.1

3.3.0-beta.1

3.3.0-beta.2

3.3.0-beta.3

3.3.0-rc.1

4.*

4.0.0-beta.1

4.0.0-beta.2

4.0.0-beta.3

4.0.0-beta.4

4.0.0-rc.1

4.1.0

4.1.0-beta.1

4.1.0-beta.2

4.1.0-rc.1

4.2.0-beta.1

4.3.0-beta.1

4.3.0-beta.2

4.3.0-beta.3

4.3.0-rc.1

5.*

5.0.0-alpha.1

5.0.0-beta.1

5.0.0-beta.2

5.0.0-beta.3

5.0.0-beta.4

5.0.0-beta.5

5.0.0-rc.1

5.1.0-beta.1

5.1.0-beta.2

5.1.0-beta.3

5.1.0-rc.1

5.2.0-alpha.1

5.2.0-beta.1

5.2.0-beta.2

5.2.0-beta.3

5.2.0-rc.1

6.*

6.0.0-alpha.1

6.0.0-alpha.2

6.0.0-alpha.3

6.0.0-beta.1

6.0.0-beta.2

6.0.0-beta.3

6.0.0-beta.4

6.0.0-beta.5

6.0.0-rc.1

6.1.0-alpha.1

6.1.0-alpha.2

6.1.0-alpha.3

6.1.0-alpha.4

6.1.0-alpha.5

6.1.0-alpha.6

6.1.0-alpha.7

6.1.0-alpha.8

6.1.0-beta.1

6.1.0-beta.2

6.1.0-beta.3

6.1.0-beta.4

6.1.0-rc.1

6.2.0-alpha.1

6.2.0-alpha.2

6.2.0-beta.1

6.2.0-beta.2

6.2.0-beta.3

6.2.0-beta.4

6.2.0-rc.1

6.3.0-alpha.1

6.3.0-alpha.2

6.3.0-alpha.3

6.3.0-alpha.4

6.3.0-beta.1

6.3.0-beta.2

6.3.0-beta.3

6.3.0-beta.4

6.3.0-beta.5

6.3.0-rc.1

7.*

7.0.0-alpha.1

7.0.0-alpha.2

7.0.0-beta.1

7.0.0-beta.2

7.0.0-beta.3

7.0.0-beta.4

7.0.0-beta.5

7.0.0-rc.1

7.1.0-alpha.1

7.1.0-alpha.2

7.1.0-alpha.3

7.1.0-beta.1

7.1.0-beta.2

7.1.0-rc.1

7.2.0-alpha.1

v0.*

v0.20.0-preview.1

v0.20.0-rc.1-1

Database specific

vanir_signatures_modified

"2026-07-25T08:12:08Z"

vanir_signatures

[
    {
        "target": {
            "file": "graylog2-server/src/test/java/org/graylog/events/rest/EventDefinitionsResourceTest.java"
        },
        "id": "CVE-2026-65011-0f582338",
        "digest": {
            "line_hashes": [
                "331882978985711541703431588521155920855",
                "308715086877885667520083820391431740643",
                "218002238660803148795144892404690327398",
                "276760877474670685297722458616081481746",
                "189118893253210806561532765687876298607",
                "50242246623298352571881756420480596802",
                "43040393256806305892197299991244658072",
                "260410764086227323183286213100855756057",
                "235197985259979043358532087585524660985",
                "244358268893385373276872281836209594759",
                "105397549247647683732291513954164406047",
                "238555453909553065774606348002991004998",
                "148797922081059456472888020993111698338"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/graylog2/graylog2-server/commit/46a2eeba4cdbc1408ff4cbf7b466853a8acfb38d"
    },
    {
        "target": {
            "function": "duplicate",
            "file": "graylog2-server/src/main/java/org/graylog/events/rest/EventDefinitionsResource.java"
        },
        "id": "CVE-2026-65011-4d4e169f",
        "digest": {
            "function_hash": "65765839318041731480319606494900211515",
            "length": 405.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/graylog2/graylog2-server/commit/46a2eeba4cdbc1408ff4cbf7b466853a8acfb38d"
    },
    {
        "target": {
            "file": "graylog2-server/src/main/java/org/graylog/events/rest/EventDefinitionsResource.java"
        },
        "id": "CVE-2026-65011-7a886961",
        "digest": {
            "line_hashes": [
                "293936084276384939775420501327982627189",
                "328853981734995411966487680489730263321",
                "78031840610952922585038224609343746084",
                "71441886948513641156991800601717709657"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/graylog2/graylog2-server/commit/46a2eeba4cdbc1408ff4cbf7b466853a8acfb38d"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65011.json"