CVE-2026-65011: GRAYLOG2 GRAYLOG2-Server

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/{definitionId}/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private event definitions including detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings by duplicating them.

Affected products

• GRAYLOG2 GRAYLOG2-Server: up to and including 7.1.5; up to and including 7.0.10

Published 2026-07-22. Last modified 2026-07-23.