{"id":"CVE-2025-53106","summary":"Graylog vulnerable to privilege escalation through API tokens","details":"Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user knows the ID. For the attack to succeed, the attacker needs a user account in Graylog. They can then proceed to issue hand-crafted requests to the Graylog REST API and exploit a weak permission check for token creation. This issue has been patched in versions 6.2.4 and 6.3.0-rc.2. A workaround involves disabling the respective configuration found in System \u003e Configuration \u003e Users \u003e \"Allow users to create personal access tokens\".","aliases":["GHSA-3m86-c9x3-vwm9"],"modified":"2026-08-12T15:16:38.833482Z","published":"2025-07-02T13:28:08.825Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-285"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53106.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53106.json"},{"type":"ADVISORY","url":"https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-3m86-c9x3-vwm9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53106"},{"type":"FIX","url":"https://github.com/Graylog2/graylog2-server/commit/6936bd16a783c2944a3d2f1e83902062520f90e3"},{"type":"FIX","url":"https://github.com/Graylog2/graylog2-server/commit/9215b8f1fd32566c31e6f7447ed864df3590c157"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/graylog2/graylog2-server","events":[{"introduced":"f35438d187e32050ff4d51e4fb93a70341982ceb"},{"fixed":"a78fb0509479a3717340c08b017473f871dc99f7"},{"introduced":"0d8cfbd6a83f50904266dfaa9b89e9c9c7871d6f"},{"fixed":"6936bd16a783c2944a3d2f1e83902062520f90e3"},{"fixed":"9215b8f1fd32566c31e6f7447ed864df3590c157"}],"database_specific":{"extracted_events":[{"introduced":"6.2.0"},{"fixed":"6.2.4"},{"introduced":"6.3.0-NA"},{"last_affected":"6.3.0-NA"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:graylog:graylog:*:*:*:*:*:*:*:*","cpe:2.3:a:graylog:graylog:6.3.0:-:*:*:*:*:*:*"]}}],"versions":["6.3.0-NA","6.2.3","6.2.2","6.2.1","6.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53106.json","vanir_signatures_modified":"2026-08-12T15:16:38Z","vanir_signatures":[{"id":"CVE-2025-53106-0216eb68","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/9215b8f1fd32566c31e6f7447ed864df3590c157","target":{"file":"graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java","function":"generateNewToken"},"deprecated":false,"digest":{"function_hash":"297229178380450500879284396330758389670","length":1098}},{"signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/9215b8f1fd32566c31e6f7447ed864df3590c157","target":{"file":"graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["277470025549068196207473872230798702756","213350747248685894180288269430623234210","46285345180184784750628872071141498174","198857085031748927083092994901829663926","19043489527634619119675029873731552360","74821875793967852550681757980157606349","171472310630970994858951151706521670169","160511112623206634128824880142862707967","187958191288577331409581309876689933528"]},"id":"CVE-2025-53106-03b34746","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"128554153462761691944501812987311941228","length":517},"id":"CVE-2025-53106-25313d41","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/6936bd16a783c2944a3d2f1e83902062520f90e3","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/users/UsersResourceTest.java","function":"createTokenFailsIfCreateNotAllowed"}},{"digest":{"function_hash":"5759872377490520259959178995752506061","length":749},"id":"CVE-2025-53106-3f15c815","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/9215b8f1fd32566c31e6f7447ed864df3590c157","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/users/UsersResourceTest.java","function":"prepareMocks"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"312793707894831113562892474324059958809","length":741},"id":"CVE-2025-53106-6b1083a4","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/9215b8f1fd32566c31e6f7447ed864df3590c157","target":{"function":"adminCanCreateTokensForOtherUsers","file":"graylog2-server/src/test/java/org/graylog2/rest/resources/users/UsersResourceTest.java"}},{"digest":{"line_hashes":["90485983575100156530752129856638387817","334262487353112448617567553208708463259","230821171301508621385307411815876768725","181680008639747164753567723491294776498","104783717114479473243916264962590368492","150526876918479547853710265495709451617","307839165573127510375648079042549267692","143410415836754432310931151659918814514","247166672828119334267051469497598589447","129771926698474027642390985853157920927","186719045349405309667551995282647919188","308738101167914240022360065304595450134","247166672828119334267051469497598589447","11628761433708715049366468159301196242","66312281964889362805059983141731639102","325067917381758429547447760899376886181","79675155063705604784114208205180268139","103054866953463833048278290282097977060","229351144939156181907215549670814206823","183156115301673578273001617387225750423","66883313176635216595628157474393036419","74414724297447318528429611578222181172","88062321217513793133802325665431005485","329711255935078113456050451609132496397","24259688101776805737816002010921207006","211474543409470562152178564164818330092","332622726385076205681484060570106467647","234381670040876436661088387640845306822","248829368029167873496512016883098041114","322997815328925434252262268658806225208","15245998996468238531922042996273203081","70004651412761142804958023837780506903","171329267537587350556450969906368060648","132062207096886186836163228353617543798","166804417023476019159104163999417224258","215927012246559519535138397224078388641","227681462415743017494432527162237815361","89186080646741060350895919608605789522","249009100372829343648769539890403504863","147205041120201762334732002648366123906","284777408568448224845966838219159971819","129480674920027252771135169435756387777","95681988771765882354356264335974957764","110276464390579022586927278271765261730","272099790243565143835621719938034628995"],"threshold":0.9},"id":"CVE-2025-53106-6d88e812","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/6936bd16a783c2944a3d2f1e83902062520f90e3","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/users/UsersResourceTest.java"},"deprecated":false},{"digest":{"line_hashes":["277470025549068196207473872230798702756","213350747248685894180288269430623234210","46285345180184784750628872071141498174","198857085031748927083092994901829663926","19043489527634619119675029873731552360","74821875793967852550681757980157606349","171472310630970994858951151706521670169","160511112623206634128824880142862707967","187958191288577331409581309876689933528"],"threshold":0.9},"id":"CVE-2025-53106-7321cc7a","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/6936bd16a783c2944a3d2f1e83902062520f90e3","target":{"file":"graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java"},"deprecated":false},{"target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/users/UsersResourceTest.java","function":"createTokenSucceedsEvenWithNULLBody"},"deprecated":false,"digest":{"length":684,"function_hash":"213131985206594044247049977106754514061"},"id":"CVE-2025-53106-81fdc148","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/9215b8f1fd32566c31e6f7447ed864df3590c157"},{"source":"https://github.com/graylog2/graylog2-server/commit/6936bd16a783c2944a3d2f1e83902062520f90e3","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/users/UsersResourceTest.java","function":"createTokenSucceedsEvenWithNULLBody"},"deprecated":false,"digest":{"function_hash":"213131985206594044247049977106754514061","length":684},"id":"CVE-2025-53106-887ce7d5","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"334266242612553873265028823611117179690","length":435},"id":"CVE-2025-53106-8c65f639","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/6936bd16a783c2944a3d2f1e83902062520f90e3","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/users/UsersResourceTest.java","function":"createTokenAndPrepareMocks"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["90485983575100156530752129856638387817","334262487353112448617567553208708463259","230821171301508621385307411815876768725","181680008639747164753567723491294776498","104783717114479473243916264962590368492","150526876918479547853710265495709451617","307839165573127510375648079042549267692","143410415836754432310931151659918814514","247166672828119334267051469497598589447","129771926698474027642390985853157920927","186719045349405309667551995282647919188","308738101167914240022360065304595450134","247166672828119334267051469497598589447","11628761433708715049366468159301196242","66312281964889362805059983141731639102","325067917381758429547447760899376886181","79675155063705604784114208205180268139","103054866953463833048278290282097977060","229351144939156181907215549670814206823","183156115301673578273001617387225750423","66883313176635216595628157474393036419","74414724297447318528429611578222181172","88062321217513793133802325665431005485","329711255935078113456050451609132496397","24259688101776805737816002010921207006","211474543409470562152178564164818330092","332622726385076205681484060570106467647","234381670040876436661088387640845306822","248829368029167873496512016883098041114","322997815328925434252262268658806225208","15245998996468238531922042996273203081","70004651412761142804958023837780506903","171329267537587350556450969906368060648","132062207096886186836163228353617543798","166804417023476019159104163999417224258","215927012246559519535138397224078388641","227681462415743017494432527162237815361","89186080646741060350895919608605789522","249009100372829343648769539890403504863","147205041120201762334732002648366123906","284777408568448224845966838219159971819","129480674920027252771135169435756387777","95681988771765882354356264335974957764","110276464390579022586927278271765261730","272099790243565143835621719938034628995"],"threshold":0.9},"id":"CVE-2025-53106-96612bec","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/9215b8f1fd32566c31e6f7447ed864df3590c157","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/users/UsersResourceTest.java"}},{"deprecated":false,"digest":{"function_hash":"312793707894831113562892474324059958809","length":741},"id":"CVE-2025-53106-9fc0ba43","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/6936bd16a783c2944a3d2f1e83902062520f90e3","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/users/UsersResourceTest.java","function":"adminCanCreateTokensForOtherUsers"}},{"id":"CVE-2025-53106-b387e57d","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/9215b8f1fd32566c31e6f7447ed864df3590c157","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/users/UsersResourceTest.java","function":"createTokenFailsIfCreateNotAllowed"},"deprecated":false,"digest":{"function_hash":"128554153462761691944501812987311941228","length":517}},{"digest":{"function_hash":"297229178380450500879284396330758389670","length":1098},"id":"CVE-2025-53106-b54bddc8","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/6936bd16a783c2944a3d2f1e83902062520f90e3","target":{"file":"graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java","function":"generateNewToken"},"deprecated":false},{"id":"CVE-2025-53106-d2200c84","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/9215b8f1fd32566c31e6f7447ed864df3590c157","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/users/UsersResourceTest.java","function":"createTokenAndPrepareMocks"},"deprecated":false,"digest":{"function_hash":"234522821003989590075115094527373712990","length":1534}},{"deprecated":false,"digest":{"function_hash":"234522821003989590075115094527373712990","length":1534},"id":"CVE-2025-53106-e02849b1","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/6936bd16a783c2944a3d2f1e83902062520f90e3","target":{"function":"createTokenAndPrepareMocks","file":"graylog2-server/src/test/java/org/graylog2/rest/resources/users/UsersResourceTest.java"}},{"digest":{"function_hash":"221774421853992776215067017851329155669","length":499},"id":"CVE-2025-53106-e97f7038","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/9215b8f1fd32566c31e6f7447ed864df3590c157","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/users/UsersResourceTest.java","function":"regularUserCannotCreateTokensForOtherUsers"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"221774421853992776215067017851329155669","length":499},"id":"CVE-2025-53106-f7c89cde","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/6936bd16a783c2944a3d2f1e83902062520f90e3","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/users/UsersResourceTest.java","function":"regularUserCannotCreateTokensForOtherUsers"}},{"signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/9215b8f1fd32566c31e6f7447ed864df3590c157","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/users/UsersResourceTest.java","function":"createTokenAndPrepareMocks"},"deprecated":false,"digest":{"length":435,"function_hash":"334266242612553873265028823611117179690"},"id":"CVE-2025-53106-f86d8db9","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/6936bd16a783c2944a3d2f1e83902062520f90e3","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/users/UsersResourceTest.java","function":"prepareMocks"},"deprecated":false,"digest":{"function_hash":"5759872377490520259959178995752506061","length":749},"id":"CVE-2025-53106-fe150578","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}]}