CVE-2025-53106: Graylog Privilege Escalation Vulnerability

CVE-2025-53106 Overview

CVE-2025-53106 is a privilege escalation vulnerability in Graylog, a free and open log management platform. The vulnerability exists in versions 6.2.0 through 6.2.3 and 6.3.0-alpha.1 through 6.3.0-rc.1, where authenticated users can exploit a weak permission check in the token creation API to generate API tokens for any user, including the local Administrator account. This allows attackers to impersonate privileged users and gain elevated access to the Graylog system.

Critical Impact

Authenticated attackers can create API tokens for any user including administrators, enabling complete system compromise through impersonation of privileged accounts.

Affected Products

• Graylog versions 6.2.0 to 6.2.3
• Graylog versions 6.3.0-alpha.1 through 6.3.0-rc.1
• Graylog 6.3.0 (pre-release versions including alpha, beta, and rc1)

Discovery Timeline

• July 2, 2025 - CVE-2025-53106 published to NVD
• October 30, 2025 - Last updated in NVD database

Technical Details for CVE-2025-53106

Vulnerability Analysis

This vulnerability is classified as CWE-285 (Improper Authorization). The flaw resides in the Graylog REST API's token creation endpoint, specifically in the UsersResource.java file. The vulnerable code improperly validates permissions by checking if the current user has token creation permissions against their own username rather than verifying permissions against the target user for whom the token is being created.

The attack requires an authenticated user account within the Graylog system. Once authenticated, the attacker can craft malicious requests to the REST API targeting any user ID, including the local Administrator account. Since the permission check validates against the requesting user's name instead of the target user's name, the authorization check passes incorrectly, allowing token creation for arbitrary users.

Root Cause

The root cause lies in a flawed permission verification logic in the token generation endpoint. The vulnerable code retrieved the current user and checked if that user had permission to create tokens for themselves (isPermitted(USERS_TOKENCREATE, currentUser.getName())), rather than checking whether they had permission to create tokens for the futureOwner (the target user specified in the request). This allowed any user with basic token creation privileges to generate tokens for any other user in the system, as long as they knew the target user's ID.

Attack Vector

The attack is network-based and requires prior authentication to the Graylog system. An attacker with a valid user account can issue hand-crafted HTTP requests to the Graylog REST API's token creation endpoint. By specifying another user's ID (such as the Administrator's ID) in the request, the attacker bypasses the weak permission check and obtains an API token that provides full access as the targeted user. This token can then be used for persistent privileged access to the Graylog environment.

// Vulnerable code (before patch) - from UsersResource.java
final User futureOwner = loadUserById(userId);
final User currentUser = getCurrentUser();

if (currentUser == null) {
    throw new ForbiddenException("Not allowed to create tokens for unknown user.");
}
// VULNERABILITY: Permission check against currentUser instead of futureOwner
if (!isPermitted(USERS_TOKENCREATE, currentUser.getName())) {
    throw new ForbiddenException(currentUser.getName() + " is not allowed to create token.");
}

// Patched code - validates against the target user (futureOwner)
final User futureOwner = loadUserById(userId);

if (!isPermitted(USERS_TOKENCREATE, futureOwner.getName())) {
    throw new ForbiddenException("You are not allowed to create a token for user " + futureOwner.getName() + ".");
}

Source: GitHub Security Patch

Detection Methods for CVE-2025-53106

Indicators of Compromise

• Unusual API token creation events in Graylog audit logs, particularly tokens created for administrative or privileged user accounts
• API tokens appearing for users who did not request them, especially the local Administrator account
• Unexpected access patterns or configuration changes attributed to privileged users
• REST API calls to token creation endpoints with user IDs that differ from the authenticated session

Detection Strategies

• Monitor Graylog audit logs for token creation events and correlate the requesting user with the target user ID
• Implement alerting on any token creation requests where the target user differs from the authenticated user
• Review existing API tokens for unauthorized entries, particularly those associated with administrator accounts
• Enable detailed REST API request logging to capture the full request payload for forensic analysis

Monitoring Recommendations

• Enable comprehensive logging of all REST API authentication and authorization events
• Set up alerts for privilege escalation patterns, including token creation for users other than the requesting party
• Regularly audit the list of active API tokens across all user accounts
• Monitor for unusual administrative actions that may indicate compromised credentials or tokens

How to Mitigate CVE-2025-53106

Immediate Actions Required

• Upgrade Graylog to version 6.2.4 or 6.3.0-rc.2 or later immediately
• If immediate upgrade is not possible, disable personal access token creation as a temporary workaround
• Audit all existing API tokens and revoke any that appear suspicious or unauthorized
• Review Graylog access logs for signs of exploitation prior to patching

Patch Information

Graylog has released security patches addressing this vulnerability. Users should upgrade to version 6.2.4 for the 6.2.x release line or version 6.3.0-rc.2 or later for the 6.3.x release line. The patches correct the permission check to properly validate against the target user (futureOwner) rather than the requesting user. For detailed patch information, refer to the GitHub Security Advisory and the security commits: commit 6936bd1 and commit 9215b8f.

Workarounds

• Navigate to System > Configuration > Users in the Graylog web interface and disable "Allow users to create personal access tokens"
• Restrict network access to the Graylog REST API to trusted administrative networks only
• Implement additional authentication layers such as VPN or IP whitelisting for API access
• Consider temporarily revoking token creation permissions from non-essential user accounts until the patch can be applied

# Configuration workaround - disable personal access tokens
# In Graylog web interface:
# Navigate to: System > Configuration > Users
# Disable: "Allow users to create personal access tokens"

# Alternative: Restrict API access at the network level
# Example iptables rule to limit API access to trusted network
iptables -A INPUT -p tcp --dport 9000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP