Graylog vulnerable to privilege escalation through API tokens

Summary

Graylog versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2 are vulnerable to a privilege escalation issue. Attackers with a valid user account can create API tokens for other users, including the local Administrator, by exploiting weak permission checks in the Graylog REST API.

Impact

Successful exploitation allows an attacker to escalate privileges, potentially gaining access to sensitive actions or data with elevated rights. This can lead to full compromise depending on the permissions of the targeted user.

Affected Products

CVSS Metrics

CWE Information

Action Information