{"id":"CVE-2026-69190","summary":"Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards","details":"Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.","aliases":["GHSA-m9c2-85gv-8xr5"],"modified":"2026-09-23T08:23:18.566130Z","published":"2026-09-21T17:46:30.702Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-639","CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69190.json"},"references":[{"type":"WEB","url":"https://github.com/Graylog2/graylog2-server/releases/tag/6.3.14"},{"type":"WEB","url":"https://github.com/Graylog2/graylog2-server/releases/tag/7.0.9"},{"type":"WEB","url":"https://github.com/Graylog2/graylog2-server/releases/tag/7.1.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69190.json"},{"type":"ADVISORY","url":"https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-m9c2-85gv-8xr5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69190"},{"type":"FIX","url":"https://github.com/Graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4"},{"type":"FIX","url":"https://github.com/Graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2"},{"type":"FIX","url":"https://github.com/Graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608"},{"type":"FIX","url":"https://github.com/Graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42"},{"type":"FIX","url":"https://github.com/Graylog2/graylog2-server/pull/26344"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/graylog2/graylog2-server","events":[{"introduced":"0d8cfbd6a83f50904266dfaa9b89e9c9c7871d6f"},{"introduced":"a788678da94b3b61a78992955f534c733f105649"},{"introduced":"549ae7f6d53c3736491674c8e1214d2d88e990a2"},{"fixed":"b6e260f2c8a4eca6e7896249e932775c3a137dc2"},{"fixed":"1b18ef7feaeb039a3f9c24732b9976a764e01691"},{"fixed":"09a50652ae55181358cd53372b5a58ef872d451e"},{"fixed":"9303f395dd29c03abd8885f1c7d1c90f8aae72d4"},{"fixed":"ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2"},{"fixed":"c87879642537d07760a572ba01b76cb657582608"},{"fixed":"e98c6670d05748a9749ab0646be7f40561734b42"}],"database_specific":{"extracted_events":[{"introduced":"6.3.0"},{"fixed":"6.3.14"},{"introduced":"7.0.0"},{"fixed":"7.0.9"},{"introduced":"7.1.0"},{"fixed":"7.1.4"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["6.3.13","7.0.8","7.1.3","6.3.12","7.0.7","7.1.2","7.1.1","7.1.0","6.3.11","7.0.6","6.3.10","7.0.5","6.3.9","7.0.4","6.3.8","7.0.3","6.3.7","7.0.2","7.0.1","6.3.6","7.0.0","6.3.5","6.3.4","6.3.3","6.3.2","6.3.1","6.3.0"],"database_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4","target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java","function":"delete"},"deprecated":false,"digest":{"function_hash":"199555833882919100665397609111790420252","length":530},"id":"CVE-2026-69190-003006c6"},{"target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java"},"deprecated":false,"digest":{"line_hashes":["299313007858339115340016307477008046794","70515641700344542618235043169077200017","80991012443605209582659784102559164357","329275937427201074888266949119879006896","67393896188936572446667541431755764229","137867353192931951307718095932210032889","157569988019655502028755888518976398657","35962207724311366961753102938139426229","325593316348735818428430827828037776852","192365886433937497086633582771551381311","307150258697122116409463159678132637999","168992590629631543341522812274941098784","308909812956418303351437481797981461426","81794324660014724364129390215726815633","270576973096048200428475215412488632159","218222698725866558112011823511128876704","307797074726678796797671910523536537359","319951496636151917103729959699638800172","84117688713144538346543511024921544306","249274738743456517119883648966632423500","151210669615830908811234525810948491093","282140163672001741091716105420701218697","182011171245053472055306143907808721413","166030405611580398597302532169967276503","68415083754867210023973564909881493666","155156872923228860521986286497814150527","28763350231386221969358288473361939374","293159024364612826610828607576123186418","76342502086100542205341170801551257036","296833848873911695745152907601209350047","62298272617169404365159873795230903605","233623497229293255506928712766941594554","187237145294467594831696352434985207978","98565879930743005863332506426884571298","61262856015959103407479575276319645773","240961689327450698616645491839407118987"],"threshold":0.9},"id":"CVE-2026-69190-003f9318","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2"},{"digest":{"function_hash":"80611335408142260417788990411064741565","length":336},"id":"CVE-2026-69190-0d00303b","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4","target":{"function":"updateViewSharing","file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4","target":{"file":"graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/ViewsResourceTest.java","function":"createViewsResource"},"deprecated":false,"digest":{"function_hash":"4978115065546873587608385091184017202","length":761},"id":"CVE-2026-69190-0f6ba9af","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608","target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java","function":"update"},"deprecated":false,"digest":{"function_hash":"332890357774501749538398276603965367857","length":558},"id":"CVE-2026-69190-113fdd78","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"121471440701187447838917180618327710701","length":582},"id":"CVE-2026-69190-22bf6097","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4","target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java","function":"update"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4","target":{"file":"graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/ViewsResourceTest.java"},"deprecated":false,"digest":{"line_hashes":["83258569141281711866439657334008982175","51112755650246780327613582311600994217","326492086790877655109580694862512431043","139420311714501663831852722955473301437","137867353192931951307718095932210032889","157569988019655502028755888518976398657","35962207724311366961753102938139426229","163756971093345396943471546693010223184","174708871843305514691447712379557559891","268482343881881086318913439669409117662","277967975554071210632793586451848518938","68115180719098504091443974054145115120","329909806166923972982065566596140705370","291789187018347797622188168028639599849","234354075462335333012905528911684259475","57191955449487702899674617747411921767","323533079001328019665512898446745699795","328225815738476312494601665605107539063","131978213359874390847401268950086512166"],"threshold":0.9},"id":"CVE-2026-69190-2a0081ab"},{"id":"CVE-2026-69190-2d0dca75","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2","target":{"file":"graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/ViewsResourceTest.java"},"deprecated":false,"digest":{"line_hashes":["83258569141281711866439657334008982175","51112755650246780327613582311600994217","326492086790877655109580694862512431043","139420311714501663831852722955473301437","137867353192931951307718095932210032889","157569988019655502028755888518976398657","35962207724311366961753102938139426229","163756971093345396943471546693010223184","174708871843305514691447712379557559891","268482343881881086318913439669409117662","277967975554071210632793586451848518938","68115180719098504091443974054145115120","329909806166923972982065566596140705370","291789187018347797622188168028639599849","234354075462335333012905528911684259475","57191955449487702899674617747411921767","323533079001328019665512898446745699795","328225815738476312494601665605107539063","131978213359874390847401268950086512166"],"threshold":0.9}},{"digest":{"function_hash":"80611335408142260417788990411064741565","length":336},"id":"CVE-2026-69190-3774b851","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2","target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java","function":"updateViewSharing"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"4978115065546873587608385091184017202","length":761},"id":"CVE-2026-69190-3d510d7d","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2","target":{"file":"graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/ViewsResourceTest.java","function":"createViewsResource"}},{"id":"CVE-2026-69190-4b5cc529","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608","target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java","function":"updateViewSharing"},"deprecated":false,"digest":{"function_hash":"231945011687705721808108614934406104016","length":344}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608","target":{"file":"graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/ViewsResourceTest.java"},"deprecated":false,"digest":{"line_hashes":["83258569141281711866439657334008982175","51112755650246780327613582311600994217","326492086790877655109580694862512431043","139420311714501663831852722955473301437","192478454574559573833720901206209376332","132689176588774926700815496300352802365","216865471574825357441026009635104989029","247375094664318565095561973598925833612","227799148821679704689528956427066418156","268482343881881086318913439669409117662","277967975554071210632793586451848518938","68115180719098504091443974054145115120","329909806166923972982065566596140705370","291789187018347797622188168028639599849","234354075462335333012905528911684259475","62770068293928546323641242319542243879","323533079001328019665512898446745699795","328225815738476312494601665605107539063","131978213359874390847401268950086512166"],"threshold":0.9},"id":"CVE-2026-69190-4bf05c90"},{"source":"https://github.com/graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42","target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java","function":"createView"},"deprecated":false,"digest":{"function_hash":"214512587569669917146749325960395068177","length":639},"id":"CVE-2026-69190-590a058c","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-69190-628d928d","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42","target":{"file":"graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/ViewsResourceTest.java","function":"createViewsResource"},"deprecated":false,"digest":{"function_hash":"4978115065546873587608385091184017202","length":761}},{"deprecated":false,"digest":{"line_hashes":["299313007858339115340016307477008046794","70515641700344542618235043169077200017","80991012443605209582659784102559164357","329275937427201074888266949119879006896","67393896188936572446667541431755764229","137867353192931951307718095932210032889","157569988019655502028755888518976398657","35962207724311366961753102938139426229","325593316348735818428430827828037776852","192365886433937497086633582771551381311","307150258697122116409463159678132637999","168992590629631543341522812274941098784","308909812956418303351437481797981461426","81794324660014724364129390215726815633","270576973096048200428475215412488632159","218222698725866558112011823511128876704","307797074726678796797671910523536537359","319951496636151917103729959699638800172","84117688713144538346543511024921544306","249274738743456517119883648966632423500","151210669615830908811234525810948491093","282140163672001741091716105420701218697","182011171245053472055306143907808721413","166030405611580398597302532169967276503","68415083754867210023973564909881493666","155156872923228860521986286497814150527","28763350231386221969358288473361939374","293159024364612826610828607576123186418","76342502086100542205341170801551257036","296833848873911695745152907601209350047","62298272617169404365159873795230903605","233623497229293255506928712766941594554","187237145294467594831696352434985207978","98565879930743005863332506426884571298","61262856015959103407479575276319645773","240961689327450698616645491839407118987"],"threshold":0.9},"id":"CVE-2026-69190-725fbf6e","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4","target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java"}},{"digest":{"line_hashes":["299313007858339115340016307477008046794","70515641700344542618235043169077200017","80991012443605209582659784102559164357","329275937427201074888266949119879006896","67393896188936572446667541431755764229","137867353192931951307718095932210032889","157569988019655502028755888518976398657","35962207724311366961753102938139426229","308909812956418303351437481797981461426","81794324660014724364129390215726815633","270576973096048200428475215412488632159","218222698725866558112011823511128876704","307797074726678796797671910523536537359","319951496636151917103729959699638800172","84117688713144538346543511024921544306","249274738743456517119883648966632423500","151210669615830908811234525810948491093","282140163672001741091716105420701218697","182011171245053472055306143907808721413","166030405611580398597302532169967276503","68415083754867210023973564909881493666","155156872923228860521986286497814150527","28763350231386221969358288473361939374","293159024364612826610828607576123186418","76342502086100542205341170801551257036","296833848873911695745152907601209350047","62298272617169404365159873795230903605","233623497229293255506928712766941594554","187237145294467594831696352434985207978","98565879930743005863332506426884571298","61262856015959103407479575276319645773","240961689327450698616645491839407118987"],"threshold":0.9},"id":"CVE-2026-69190-76eb3bf4","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42","target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java"},"deprecated":false},{"id":"CVE-2026-69190-839e19a5","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608","target":{"file":"graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/ViewsResourceTest.java","function":"createViewsResource"},"deprecated":false,"digest":{"function_hash":"83580781657298443553221210230113011991","length":732}},{"deprecated":false,"digest":{"line_hashes":["299313007858339115340016307477008046794","70515641700344542618235043169077200017","80991012443605209582659784102559164357","329275937427201074888266949119879006896","67393896188936572446667541431755764229","132689176588774926700815496300352802365","216865471574825357441026009635104989029","247375094664318565095561973598925833612","308909812956418303351437481797981461426","81794324660014724364129390215726815633","270576973096048200428475215412488632159","218222698725866558112011823511128876704","307797074726678796797671910523536537359","173751351872273517951788941792750891204","330326018888909119773438289501481122428","145222447408283116567009996676199216917","116131135346021330040002135180316309597","186014118282513366020909347809256501505","267253274009477111645629838632737659806","166030405611580398597302532169967276503","68415083754867210023973564909881493666","155156872923228860521986286497814150527","28763350231386221969358288473361939374","110173675768131654417766186747346502212","76342502086100542205341170801551257036","194545658918981798606091708963368023264","110414785648186937545246066645908999402","143432630882019911895318960558786488473","187237145294467594831696352434985207978","98565879930743005863332506426884571298","61262856015959103407479575276319645773","240961689327450698616645491839407118987"],"threshold":0.9},"id":"CVE-2026-69190-8f050759","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608","target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java"}},{"signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608","target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java","function":"create"},"deprecated":false,"digest":{"function_hash":"57651667732946791540911201845213890318","length":722},"id":"CVE-2026-69190-977ac2a8","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"332890357774501749538398276603965367857","length":558},"id":"CVE-2026-69190-9c78d6bc","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42","target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java","function":"update"}},{"digest":{"function_hash":"214512587569669917146749325960395068177","length":639},"id":"CVE-2026-69190-a7f80394","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/9303f395dd29c03abd8885f1c7d1c90f8aae72d4","target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java","function":"createView"},"deprecated":false},{"source":"https://github.com/graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2","target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java","function":"update"},"deprecated":false,"digest":{"function_hash":"121471440701187447838917180618327710701","length":582},"id":"CVE-2026-69190-ad26da64","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42","target":{"file":"graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/ViewsResourceTest.java"},"deprecated":false,"digest":{"line_hashes":["83258569141281711866439657334008982175","51112755650246780327613582311600994217","326492086790877655109580694862512431043","139420311714501663831852722955473301437","137867353192931951307718095932210032889","157569988019655502028755888518976398657","35962207724311366961753102938139426229","163756971093345396943471546693010223184","174708871843305514691447712379557559891","268482343881881086318913439669409117662","277967975554071210632793586451848518938","68115180719098504091443974054145115120","329909806166923972982065566596140705370","291789187018347797622188168028639599849","234354075462335333012905528911684259475","57191955449487702899674617747411921767","323533079001328019665512898446745699795","328225815738476312494601665605107539063","131978213359874390847401268950086512166"],"threshold":0.9},"id":"CVE-2026-69190-c3a610df"},{"deprecated":false,"digest":{"function_hash":"199555833882919100665397609111790420252","length":530},"id":"CVE-2026-69190-c4bc80da","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2","target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java","function":"delete"}},{"deprecated":false,"digest":{"function_hash":"80611335408142260417788990411064741565","length":336},"id":"CVE-2026-69190-d88cc97f","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42","target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java","function":"updateViewSharing"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/c87879642537d07760a572ba01b76cb657582608","target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java","function":"delete"},"deprecated":false,"digest":{"function_hash":"142274435421154432507334807016847501534","length":529},"id":"CVE-2026-69190-e4789d7a"},{"signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/ac1c0b19e3f44c2eed8e95f4d398ba455e30a8f2","target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java","function":"createView"},"deprecated":false,"digest":{"function_hash":"214512587569669917146749325960395068177","length":639},"id":"CVE-2026-69190-f267461d","signature_type":"Function"},{"id":"CVE-2026-69190-f96647c8","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/e98c6670d05748a9749ab0646be7f40561734b42","target":{"file":"graylog2-server/src/main/java/org/graylog/plugins/views/search/rest/ViewsResource.java","function":"delete"},"deprecated":false,"digest":{"function_hash":"142274435421154432507334807016847501534","length":529}}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-69190.json","vanir_signatures_modified":"2026-09-23T08:23:18Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}]}