Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-639",
"CWE-862"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69190.json"
}{
"extracted_events": [
{
"introduced": "6.3.0"
},
{
"fixed": "6.3.14"
},
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.9"
},
{
"introduced": "7.1.0"
},
{
"fixed": "7.1.4"
}
],
"source": [
"AFFECTED_FIELD",
"REFERENCES"
]
}
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69190.json"
[
{
"deprecated": false,
"digest": {
"function_hash": "199555833882919100665397609111790420252",
"length": 530
},
"id": "CVE-2026-69190-003006c6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java",
"function": "delete"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"299313007858339115340016307477008046794",
"70515641700344542618235043169077200017",
"80991012443605209582659784102559164357",
"329275937427201074888266949119879006896",
"67393896188936572446667541431755764229",
"137867353192931951307718095932210032889",
"157569988019655502028755888518976398657",
"35962207724311366961753102938139426229",
"325593316348735818428430827828037776852",
"192365886433937497086633582771551381311",
"307150258697122116409463159678132637999",
"168992590629631543341522812274941098784",
"308909812956418303351437481797981461426",
"81794324660014724364129390215726815633",
"270576973096048200428475215412488632159",
"218222698725866558112011823511128876704",
"307797074726678796797671910523536537359",
"319951496636151917103729959699638800172",
"84117688713144538346543511024921544306",
"249274738743456517119883648966632423500",
"151210669615830908811234525810948491093",
"282140163672001741091716105420701218697",
"182011171245053472055306143907808721413",
"166030405611580398597302532169967276503",
"68415083754867210023973564909881493666",
"155156872923228860521986286497814150527",
"28763350231386221969358288473361939374",
"293159024364612826610828607576123186418",
"76342502086100542205341170801551257036",
"296833848873911695745152907601209350047",
"62298272617169404365159873795230903605",
"233623497229293255506928712766941594554",
"187237145294467594831696352434985207978",
"98565879930743005863332506426884571298",
"61262856015959103407479575276319645773",
"240961689327450698616645491839407118987"
],
"threshold": 0.9
},
"id": "CVE-2026-69190-003f9318",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "80611335408142260417788990411064741565",
"length": 336
},
"id": "CVE-2026-69190-0d00303b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java",
"function": "updateViewSharing"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "4978115065546873587608385091184017202",
"length": 761
},
"id": "CVE-2026-69190-0f6ba9af",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4",
"target": {
"file": "graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/ViewsResourceTest.java",
"function": "createViewsResource"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "332890357774501749538398276603965367857",
"length": 558
},
"id": "CVE-2026-69190-113fdd78",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java",
"function": "update"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "121471440701187447838917180618327710701",
"length": 582
},
"id": "CVE-2026-69190-22bf6097",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java",
"function": "update"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"83258569141281711866439657334008982175",
"51112755650246780327613582311600994217",
"326492086790877655109580694862512431043",
"139420311714501663831852722955473301437",
"137867353192931951307718095932210032889",
"157569988019655502028755888518976398657",
"35962207724311366961753102938139426229",
"163756971093345396943471546693010223184",
"174708871843305514691447712379557559891",
"268482343881881086318913439669409117662",
"277967975554071210632793586451848518938",
"68115180719098504091443974054145115120",
"329909806166923972982065566596140705370",
"291789187018347797622188168028639599849",
"234354075462335333012905528911684259475",
"57191955449487702899674617747411921767",
"323533079001328019665512898446745699795",
"328225815738476312494601665605107539063",
"131978213359874390847401268950086512166"
],
"threshold": 0.9
},
"id": "CVE-2026-69190-2a0081ab",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4",
"target": {
"file": "graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/ViewsResourceTest.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"83258569141281711866439657334008982175",
"51112755650246780327613582311600994217",
"326492086790877655109580694862512431043",
"139420311714501663831852722955473301437",
"137867353192931951307718095932210032889",
"157569988019655502028755888518976398657",
"35962207724311366961753102938139426229",
"163756971093345396943471546693010223184",
"174708871843305514691447712379557559891",
"268482343881881086318913439669409117662",
"277967975554071210632793586451848518938",
"68115180719098504091443974054145115120",
"329909806166923972982065566596140705370",
"291789187018347797622188168028639599849",
"234354075462335333012905528911684259475",
"57191955449487702899674617747411921767",
"323533079001328019665512898446745699795",
"328225815738476312494601665605107539063",
"131978213359874390847401268950086512166"
],
"threshold": 0.9
},
"id": "CVE-2026-69190-2d0dca75",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2",
"target": {
"file": "graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/ViewsResourceTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "80611335408142260417788990411064741565",
"length": 336
},
"id": "CVE-2026-69190-3774b851",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java",
"function": "updateViewSharing"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "4978115065546873587608385091184017202",
"length": 761
},
"id": "CVE-2026-69190-3d510d7d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2",
"target": {
"file": "graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/ViewsResourceTest.java",
"function": "createViewsResource"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "231945011687705721808108614934406104016",
"length": 344
},
"id": "CVE-2026-69190-4b5cc529",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java",
"function": "updateViewSharing"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"83258569141281711866439657334008982175",
"51112755650246780327613582311600994217",
"326492086790877655109580694862512431043",
"139420311714501663831852722955473301437",
"192478454574559573833720901206209376332",
"132689176588774926700815496300352802365",
"216865471574825357441026009635104989029",
"247375094664318565095561973598925833612",
"227799148821679704689528956427066418156",
"268482343881881086318913439669409117662",
"277967975554071210632793586451848518938",
"68115180719098504091443974054145115120",
"329909806166923972982065566596140705370",
"291789187018347797622188168028639599849",
"234354075462335333012905528911684259475",
"62770068293928546323641242319542243879",
"323533079001328019665512898446745699795",
"328225815738476312494601665605107539063",
"131978213359874390847401268950086512166"
],
"threshold": 0.9
},
"id": "CVE-2026-69190-4bf05c90",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608",
"target": {
"file": "graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/ViewsResourceTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "214512587569669917146749325960395068177",
"length": 639
},
"id": "CVE-2026-69190-590a058c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java",
"function": "createView"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "4978115065546873587608385091184017202",
"length": 761
},
"id": "CVE-2026-69190-628d928d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42",
"target": {
"file": "graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/ViewsResourceTest.java",
"function": "createViewsResource"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"299313007858339115340016307477008046794",
"70515641700344542618235043169077200017",
"80991012443605209582659784102559164357",
"329275937427201074888266949119879006896",
"67393896188936572446667541431755764229",
"137867353192931951307718095932210032889",
"157569988019655502028755888518976398657",
"35962207724311366961753102938139426229",
"325593316348735818428430827828037776852",
"192365886433937497086633582771551381311",
"307150258697122116409463159678132637999",
"168992590629631543341522812274941098784",
"308909812956418303351437481797981461426",
"81794324660014724364129390215726815633",
"270576973096048200428475215412488632159",
"218222698725866558112011823511128876704",
"307797074726678796797671910523536537359",
"319951496636151917103729959699638800172",
"84117688713144538346543511024921544306",
"249274738743456517119883648966632423500",
"151210669615830908811234525810948491093",
"282140163672001741091716105420701218697",
"182011171245053472055306143907808721413",
"166030405611580398597302532169967276503",
"68415083754867210023973564909881493666",
"155156872923228860521986286497814150527",
"28763350231386221969358288473361939374",
"293159024364612826610828607576123186418",
"76342502086100542205341170801551257036",
"296833848873911695745152907601209350047",
"62298272617169404365159873795230903605",
"233623497229293255506928712766941594554",
"187237145294467594831696352434985207978",
"98565879930743005863332506426884571298",
"61262856015959103407479575276319645773",
"240961689327450698616645491839407118987"
],
"threshold": 0.9
},
"id": "CVE-2026-69190-725fbf6e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"299313007858339115340016307477008046794",
"70515641700344542618235043169077200017",
"80991012443605209582659784102559164357",
"329275937427201074888266949119879006896",
"67393896188936572446667541431755764229",
"137867353192931951307718095932210032889",
"157569988019655502028755888518976398657",
"35962207724311366961753102938139426229",
"308909812956418303351437481797981461426",
"81794324660014724364129390215726815633",
"270576973096048200428475215412488632159",
"218222698725866558112011823511128876704",
"307797074726678796797671910523536537359",
"319951496636151917103729959699638800172",
"84117688713144538346543511024921544306",
"249274738743456517119883648966632423500",
"151210669615830908811234525810948491093",
"282140163672001741091716105420701218697",
"182011171245053472055306143907808721413",
"166030405611580398597302532169967276503",
"68415083754867210023973564909881493666",
"155156872923228860521986286497814150527",
"28763350231386221969358288473361939374",
"293159024364612826610828607576123186418",
"76342502086100542205341170801551257036",
"296833848873911695745152907601209350047",
"62298272617169404365159873795230903605",
"233623497229293255506928712766941594554",
"187237145294467594831696352434985207978",
"98565879930743005863332506426884571298",
"61262856015959103407479575276319645773",
"240961689327450698616645491839407118987"
],
"threshold": 0.9
},
"id": "CVE-2026-69190-76eb3bf4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "83580781657298443553221210230113011991",
"length": 732
},
"id": "CVE-2026-69190-839e19a5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608",
"target": {
"file": "graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/ViewsResourceTest.java",
"function": "createViewsResource"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"299313007858339115340016307477008046794",
"70515641700344542618235043169077200017",
"80991012443605209582659784102559164357",
"329275937427201074888266949119879006896",
"67393896188936572446667541431755764229",
"132689176588774926700815496300352802365",
"216865471574825357441026009635104989029",
"247375094664318565095561973598925833612",
"308909812956418303351437481797981461426",
"81794324660014724364129390215726815633",
"270576973096048200428475215412488632159",
"218222698725866558112011823511128876704",
"307797074726678796797671910523536537359",
"173751351872273517951788941792750891204",
"330326018888909119773438289501481122428",
"145222447408283116567009996676199216917",
"116131135346021330040002135180316309597",
"186014118282513366020909347809256501505",
"267253274009477111645629838632737659806",
"166030405611580398597302532169967276503",
"68415083754867210023973564909881493666",
"155156872923228860521986286497814150527",
"28763350231386221969358288473361939374",
"110173675768131654417766186747346502212",
"76342502086100542205341170801551257036",
"194545658918981798606091708963368023264",
"110414785648186937545246066645908999402",
"143432630882019911895318960558786488473",
"187237145294467594831696352434985207978",
"98565879930743005863332506426884571298",
"61262856015959103407479575276319645773",
"240961689327450698616645491839407118987"
],
"threshold": 0.9
},
"id": "CVE-2026-69190-8f050759",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "57651667732946791540911201845213890318",
"length": 722
},
"id": "CVE-2026-69190-977ac2a8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java",
"function": "create"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "332890357774501749538398276603965367857",
"length": 558
},
"id": "CVE-2026-69190-9c78d6bc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java",
"function": "update"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "214512587569669917146749325960395068177",
"length": 639
},
"id": "CVE-2026-69190-a7f80394",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java",
"function": "createView"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "121471440701187447838917180618327710701",
"length": 582
},
"id": "CVE-2026-69190-ad26da64",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java",
"function": "update"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"83258569141281711866439657334008982175",
"51112755650246780327613582311600994217",
"326492086790877655109580694862512431043",
"139420311714501663831852722955473301437",
"137867353192931951307718095932210032889",
"157569988019655502028755888518976398657",
"35962207724311366961753102938139426229",
"163756971093345396943471546693010223184",
"174708871843305514691447712379557559891",
"268482343881881086318913439669409117662",
"277967975554071210632793586451848518938",
"68115180719098504091443974054145115120",
"329909806166923972982065566596140705370",
"291789187018347797622188168028639599849",
"234354075462335333012905528911684259475",
"57191955449487702899674617747411921767",
"323533079001328019665512898446745699795",
"328225815738476312494601665605107539063",
"131978213359874390847401268950086512166"
],
"threshold": 0.9
},
"id": "CVE-2026-69190-c3a610df",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42",
"target": {
"file": "graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/ViewsResourceTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "199555833882919100665397609111790420252",
"length": 530
},
"id": "CVE-2026-69190-c4bc80da",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java",
"function": "delete"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "80611335408142260417788990411064741565",
"length": 336
},
"id": "CVE-2026-69190-d88cc97f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java",
"function": "updateViewSharing"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "142274435421154432507334807016847501534",
"length": 529
},
"id": "CVE-2026-69190-e4789d7a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java",
"function": "delete"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "214512587569669917146749325960395068177",
"length": 639
},
"id": "CVE-2026-69190-f267461d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java",
"function": "createView"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "142274435421154432507334807016847501534",
"length": 529
},
"id": "CVE-2026-69190-f96647c8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42",
"target": {
"file": "graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java",
"function": "delete"
}
}
]
"2026-09-23T08:06:49Z"