GHSA-3M86-C9X3-VWM9 Graylog vulnerable to privilege escalation through API tokens

Impact Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user knows the ID. For the attack to succeed, the attacker needs a user account in Graylog. They can then proceed to issue hand-crafted requests ...

CVE-2024-52506

The CVE-2024-52506 issue affects Graylog 6.1.0–6.1.1, where the reporting feature can leak another user’s data under concurrent PDF report rendering. A shared headless browser instance is reused across simultaneous render requests; depending on timing, either a freshness check errors out or a win...

CVE-2024-52506 Graylog can leak other users' reports via concurrent PDF report rendering

Graylog is a free and open log management platform. The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboard widgets displaying individual log messages or metrics aggregated from fields of multiple log messages. This functionality, as included i...