PatchSiren

Graylog2 CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Graylog2 CVE published 2026-07-22

CVE-2026-65011

CVE-2026-65011 is a vulnerability in Graylog2 Server before commit 46a2eeb. The vulnerability is due to a missing per-entity permission check in the POST /events/definitions/{definitionId}/duplicate endpoint. This allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private event definitions including detection queries, aggr [truncated]