CVE-2026-65011: Graylog2 Privilege Escalation Vulnerability

CVE-2026-65011 Overview

CVE-2026-65011 is a missing authorization vulnerability [CWE-862] in Graylog2 Server. The POST /events/definitions/{definitionId}/duplicate endpoint does not enforce a per-entity read permission check before cloning an event definition. Any authenticated user holding the low-privilege eventdefinitions:create capability can duplicate arbitrary event definitions they were never granted access to. The duplicated object exposes the source definition's detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings. The issue was fixed in commit 46a2eeb of the graylog2-server repository.

Critical Impact
Authenticated low-privilege users can read the content of any private event definition, including detection logic and notification bindings, by invoking the duplicate endpoint.

Affected Products

Graylog2 Server versions prior to commit 46a2eeb
Deployments exposing the EventDefinitionsResource REST API
Multi-tenant Graylog installations where users hold eventdefinitions:create but not read on all definitions

Discovery Timeline

2026-07-22 - CVE-2026-65011 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-65011

Vulnerability Analysis

Graylog uses a per-entity permission model where individual event definitions can be shared with specific users or teams. The duplicate handler in EventDefinitionsResource.java enforced only the class-level EVENT_DEFINITIONS_CREATE permission through the @RequiresPermissions annotation. It did not verify that the caller was authorized to read the specific definitionId supplied in the URL. As a result, the server fetched the source definition from dbService, copied its fields into a new record, and returned the persisted duplicate to the requester. The response body exposed the full serialized event definition, giving the attacker visibility into detection logic that would otherwise remain private.

Root Cause

The root cause is a missing per-entity authorization check between the framework-level permission gate and the database read. The controller trusted the eventdefinitions:create grant as sufficient authority, conflating the right to create new definitions with the right to read existing ones. Graylog's permission subsystem exposes checkPermission(RestPermissions.EVENT_DEFINITIONS_READ, definitionId) for exactly this scenario, but the duplicate path did not call it.

Attack Vector

An authenticated attacker with the eventdefinitions:create role sends an HTTP POST to /api/events/definitions/{definitionId}/duplicate, substituting any known or enumerated definitionId. Event definition IDs are guessable through listing endpoints or predictable ordering. The server returns the cloned definition in the response body, revealing detection queries, thresholds, grouping fields, execution schedules, and linked notification targets.

java

     @AuditEvent(type = EventsAuditEventTypes.EVENT_DEFINITION_CREATE)
     @RequiresPermissions(RestPermissions.EVENT_DEFINITIONS_CREATE)
     public EventDefinitionDto duplicate(@Parameter(name = "definitionId") @PathParam("definitionId") @NotBlank String definitionId, @Context UserContext userContext) {
+        checkPermission(RestPermissions.EVENT_DEFINITIONS_READ, definitionId);
         final EventDefinitionDto eventDefinitionDto = dbService.get(definitionId).orElseThrow(() ->
                 new BadRequestException(f("Unable to find event definition '%s' to duplicate", definitionId)));
         checkEventDefinitionPermissions(eventDefinitionDto, "create");

Source: Graylog2 Server commit 46a2eeb

Detection Methods for CVE-2026-65011

Indicators of Compromise

Audit events of type EVENT_DEFINITION_CREATE sourced from users who do not own or share the referenced source definitionId.
HTTP POST requests to /api/events/definitions/{definitionId}/duplicate from accounts that hold eventdefinitions:create but lack read on the target entity.
Sudden growth in the count of duplicated event definitions belonging to a single non-administrative user.

Detection Strategies

Correlate Graylog audit log entries for the duplicate endpoint against the entity permissions table to flag calls where the caller lacks EVENT_DEFINITIONS_READ on the source ID.
Alert on repeated POST /events/definitions/*/duplicate requests iterating through sequential or enumerated definition IDs from the same session.
Baseline duplicate-endpoint usage per user role; treat spikes from low-privilege accounts as suspicious.

Monitoring Recommendations

Forward Graylog server access logs and audit events to a central analytics platform for retrospective review of the duplicate endpoint.
Enable full request logging on the REST API layer to preserve definitionId values used in duplicate calls.
Review the event_definitions collection in MongoDB for records with a title prefixed by the duplicate marker owned by non-admin users.

How to Mitigate CVE-2026-65011

Immediate Actions Required

Upgrade graylog2-server to a build containing commit 46a2eeb or later.
Audit accounts assigned the eventdefinitions:create permission and remove it from users who do not require event definition authoring.
Rotate any credentials, webhook secrets, or API tokens referenced in notification bindings that may have been exposed through duplication.

Patch Information

The fix adds checkPermission(RestPermissions.EVENT_DEFINITIONS_READ, definitionId) at the top of the duplicate handler in EventDefinitionsResource.java, ensuring the caller is authorized to read the source event definition before the clone proceeds. The change was merged via Pull Request #26706 and tracked under Issue #26590, with follow-up hardening in PR #26718 and PR #26719. See the Vulncheck advisory for vendor coordination details.

Workarounds

Restrict the eventdefinitions:create capability to trusted administrators until the patched build is deployed.
Place a reverse proxy or WAF rule in front of Graylog that blocks POST requests to /api/events/definitions/*/duplicate for non-admin user sessions.
Move highly sensitive detections to a separate Graylog cluster where only trusted operators hold event-definition permissions.

bash

# Example NGINX rule to block the duplicate endpoint pending patch
location ~ ^/api/events/definitions/[^/]+/duplicate$ {
    if ($request_method = POST) {
        return 403;
    }
    proxy_pass http://graylog_upstream;
}