CVE-2026-1436: Improper Access Control (IDOR) vulnerability in Graylog Web Interface
Graylog · Graylog Web Interface
Vendor fix available · Affected: Graylog Web Interface · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 16% of scored CVEs
DescriptionCVE.org
Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other user's profiles without proper authorization checks. Exploiting this vulnerability allows valid users of the system to be listed and sensitive third-party information to be accessed, such as names, email addresses, internal identifiers, and last activity. The endpoint 'http://<IP>:12900/users/<my_user>' does not implement object-level authorization validations.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Graylog · Graylog Web Interface2.2.3
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Weakness
- Insecure Direct Object Reference
- Vendor
- Graylog
- Published
- February 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-1436 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.