CVE-2026-65011 Details

A vulnerability exists in Graylog2 Server in versions prior to 7.1.5 and 7.0.10, where the POST /events/definitions/{definitionId}/duplicate endpoint lacks a necessary per-entity permission check. This oversight allows authenticated users with the low-privilege eventdefinitions:create capability to clone any event definition, including private ones, without proper authorization. The duplication process exposes sensitive information such as detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings. The issue arises because the endpoint does not verify if the user has been granted read access to the specific event definition being duplicated, thereby circumventing Graylog's Entity Shares access-control model for this entity type.

Users can update to Graylog2 Server versions 7.1.5 or 7.0.10, where this vulnerability has been addressed.