{"id":"CVE-2026-55425","summary":"Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields","details":"Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request composite display fields without verifying that every selected field is readable. A user can retrieve protected values, including the password hash on a readable user record; ordinary users are limited to their own permitted records, while administrators can retrieve hashes for all users. This issue is fixed in versions 7.1.4 and 7.2.0-alpha.2.","aliases":["GHSA-q79r-r9xg-r863"],"modified":"2026-09-11T08:26:28.751740Z","published":"2026-08-28T18:08:22.113Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-213"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55425.json"},"references":[{"type":"WEB","url":"https://github.com/Graylog2/graylog2-server/releases/tag/7.1.4"},{"type":"WEB","url":"https://github.com/Graylog2/graylog2-server/releases/tag/7.2.0-alpha.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55425.json"},{"type":"ADVISORY","url":"https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-q79r-r9xg-r863"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55425"},{"type":"FIX","url":"https://github.com/Graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21"},{"type":"FIX","url":"https://github.com/Graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5"},{"type":"FIX","url":"https://github.com/Graylog2/graylog2-server/pull/26284"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/graylog2/graylog2-server","events":[{"introduced":"549ae7f6d53c3736491674c8e1214d2d88e990a2"},{"introduced":"69349fc6453def1f5b7263b2e5f83c035fcbcf45"},{"fixed":"09a50652ae55181358cd53372b5a58ef872d451e"},{"fixed":"2490bd823fb47e613b15ae64ff863996f3bce978"},{"fixed":"1d1a91d99c3d2d8993e61c3c52344648163d3a21"},{"fixed":"da7767a44233b6a683d0713eed08da31ce0e77b5"}],"database_specific":{"extracted_events":[{"introduced":"7.1.0"},{"fixed":"7.1.4"},{"introduced":"7.2.0-alpha.1"},{"fixed":"7.2.0-alpha.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["7.2.0-alpha.1","7.1.3","7.1.2","7.1.1","7.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55425.json","vanir_signatures_modified":"2026-09-11T08:26:28Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["3479052352202857256996746373838171155","245446157779742326649552148479262967462","87679750187132738031584207014560198944","63649483392051268907394498481028423889","270935253397900341403104378801447462858","335705491568586460945924426579560627443","140845786348714829140553533596180844742","323369689751392983187149932962016785130","109834418999446743567984536627977930526","199859651157347070733574841657179523292","248640615235482446490172947419068408266","101683274093188008429788723242074844380","198999021854734410559371620827968398474","199865784333430033442480164585145177129","68249858884972879210421707013330966270","222997803165047329200187756648005367270"],"threshold":0.9},"id":"CVE-2026-55425-11709dc1","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceMongoTest.java"}},{"digest":{"line_hashes":["216336238613689424930595081335071587105","126847522694148917648904259369087177651","334685167679705255468003683554237921132"],"threshold":0.9},"id":"CVE-2026-55425-1c071b4b","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5","target":{"file":"graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/TestSearchUser.java"},"deprecated":false},{"target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceTest.java","function":"setUp"},"deprecated":false,"digest":{"function_hash":"245454279256059703495619961995908190951","length":84},"id":"CVE-2026-55425-242b0b17","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5"},{"deprecated":false,"digest":{"function_hash":"233497839073929648135927726096289036522","length":2458},"id":"CVE-2026-55425-49f3d7f0","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5","target":{"function":"getTitlesForEntitiesFromSingleCollection","file":"graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java"}},{"deprecated":false,"digest":{"line_hashes":["7283675089878198888444541411603804681","305390451635045314709135785259223364666","326525855710822185021945094647875000616","30797388370705136393749796756021061539","338040634464552975200270658364414052056","258689263516138002944917973104289367769","92379079661699153312123366849070301950","318443935356377307284498207996883306846","66162230955304166365478153009514589482","233052847100769589096908218804810864151","278017699349490321152409122863225827760","265696346906745787497272495747742402772","173949082521626622601518464897861094911","212298209253988698916685944804035295825","66391760239792646478589475266271324349","324763887390985226744751728181637016152","314932987783651097281477732468112844014","283604350171576088500506232238649523461"],"threshold":0.9},"id":"CVE-2026-55425-5baa520d","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21","target":{"file":"graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java"}},{"target":{"file":"graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java"},"deprecated":false,"digest":{"line_hashes":["7283675089878198888444541411603804681","305390451635045314709135785259223364666","326525855710822185021945094647875000616","30797388370705136393749796756021061539","338040634464552975200270658364414052056","258689263516138002944917973104289367769","92379079661699153312123366849070301950","318443935356377307284498207996883306846","66162230955304166365478153009514589482","233052847100769589096908218804810864151","278017699349490321152409122863225827760","265696346906745787497272495747742402772","173949082521626622601518464897861094911","212298209253988698916685944804035295825","66391760239792646478589475266271324349","324763887390985226744751728181637016152","314932987783651097281477732468112844014","283604350171576088500506232238649523461"],"threshold":0.9},"id":"CVE-2026-55425-5fbf9d3c","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5"},{"id":"CVE-2026-55425-6173127c","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21","target":{"file":"graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java","function":"EntityTitleServiceImpl"},"deprecated":false,"digest":{"function_hash":"200767409749945173084722988955821751404","length":100}},{"id":"CVE-2026-55425-61ed78ae","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21","target":{"function":"setUp","file":"graylog2-server/src/test/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceMongoTest.java"},"deprecated":false,"digest":{"function_hash":"119641773520411186903703355535916462989","length":424}},{"id":"CVE-2026-55425-7ffadf77","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21","target":{"file":"graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java","function":"getTitlesForEntitiesFromSingleCollection"},"deprecated":false,"digest":{"function_hash":"233497839073929648135927726096289036522","length":2458}},{"digest":{"line_hashes":["3479052352202857256996746373838171155","245446157779742326649552148479262967462","87679750187132738031584207014560198944","63649483392051268907394498481028423889","276195075858661762048223475291339580347","251629232698171993868103533170727923782","317760380110393167014972006880606607451","55773605084529942427600948681834895599"],"threshold":0.9},"id":"CVE-2026-55425-b417dc72","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceTest.java"},"deprecated":false},{"id":"CVE-2026-55425-cad2e84a","signature_type":"Function","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceTest.java","function":"setUp"},"deprecated":false,"digest":{"function_hash":"245454279256059703495619961995908190951","length":84}},{"digest":{"line_hashes":["3479052352202857256996746373838171155","245446157779742326649552148479262967462","87679750187132738031584207014560198944","63649483392051268907394498481028423889","276195075858661762048223475291339580347","251629232698171993868103533170727923782","317760380110393167014972006880606607451","55773605084529942427600948681834895599"],"threshold":0.9},"id":"CVE-2026-55425-cc644412","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceTest.java"},"deprecated":false},{"source":"https://github.com/graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21","target":{"file":"graylog2-server/src/test/java/org/graylog/plugins/views/search/rest/TestSearchUser.java"},"deprecated":false,"digest":{"line_hashes":["216336238613689424930595081335071587105","126847522694148917648904259369087177651","334685167679705255468003683554237921132"],"threshold":0.9},"id":"CVE-2026-55425-d920f437","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceMongoTest.java","function":"setUp"},"deprecated":false,"digest":{"function_hash":"119641773520411186903703355535916462989","length":424},"id":"CVE-2026-55425-dabc258b","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["3479052352202857256996746373838171155","245446157779742326649552148479262967462","87679750187132738031584207014560198944","63649483392051268907394498481028423889","270935253397900341403104378801447462858","335705491568586460945924426579560627443","140845786348714829140553533596180844742","323369689751392983187149932962016785130","109834418999446743567984536627977930526","199859651157347070733574841657179523292","248640615235482446490172947419068408266","101683274093188008429788723242074844380","198999021854734410559371620827968398474","199865784333430033442480164585145177129","68249858884972879210421707013330966270","222997803165047329200187756648005367270"],"threshold":0.9},"id":"CVE-2026-55425-f55d87c7","signature_type":"Line","signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/1d1a91d99c3d2d8993e61c3c52344648163d3a21","target":{"file":"graylog2-server/src/test/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceMongoTest.java"}},{"signature_version":"v1","source":"https://github.com/graylog2/graylog2-server/commit/da7767a44233b6a683d0713eed08da31ce0e77b5","target":{"file":"graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java","function":"EntityTitleServiceImpl"},"deprecated":false,"digest":{"function_hash":"200767409749945173084722988955821751404","length":100},"id":"CVE-2026-55425-fcc1227d","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"}]}