Authorization Bypass Through User-Controlled Key

Overview org.graylog2:graylog2-server is a log management platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the token revocation endpoint, which deletes an access token by its identifier without verifying that the token belongs to th...

Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

Impact Graylog contains an insecure direct object reference IDOR vulnerability in the token revocation endpoint. An authenticated user can delete access tokens belonging to other users, including service account tokens and administrator tokens, if they know or can guess a valid token identifier...

GHSA-J769-9GV9-65GR Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

Impact Graylog contains an insecure direct object reference IDOR vulnerability in the token revocation endpoint. An authenticated user can delete access tokens belonging to other users, including service account tokens and administrator tokens, if they know or can guess a valid token identifier...

CVE-2026-55867

Graylog (a log management platform) is affected in versions 6.2.0 through 6.3.12, 7.0.7, and 7.1.2 . The vulnerability resides in the DELETE /users/{userId}/tokens/{idOrToken} endpoint (UsersResource.revokeToken()), where the USERS_TOKENREMOVE permission is checked against an attacker-controlled ...

EUVD-2026-68014

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/userId/tokens/idOrToken endpoint implemented by UsersResource.revokeToken in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERSTOKENREMOVE...

CVE-2026-55867 Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/userId/tokens/idOrToken endpoint implemented by UsersResource.revokeToken in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERSTOKENREMOVE...

CVE-2026-55867 Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/userId/tokens/idOrToken endpoint implemented by UsersResource.revokeToken in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERSTOKENREMOVE...

CVE-2026-55867 Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/userId/tokens/idOrToken endpoint implemented by UsersResource.revokeToken in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERSTOKENREMOVE...

CVE-2026-55764 Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go allows a mint-role holder to bypass a finite per-nonce MaxSupply on the semi-fungible token add-quantity path. In core/kapp/systemAccount/systemAcount.go, SFTAddCirculation performed meta.Circulation ...

klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits

Summary In processPercentageRoyaltiesTransfer the royalty pool is collected from the sender by SubFromBalance that is ordered after the split loop and after if royaltiesToPay royaltiesToPay, so a split entry of exactly 100% PercentTransferPercentage = 10000 is a valid config: it drives...

CVE-2026-55763 Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay royaltiesToPay, so a valid PercentTransferPercentage = 10000 split...

CVE-2026-82289

Gitingest through 0.3.1 fails to properly validate hostnames in validatehost, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and...

CVE-2026-55485

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccoloadmin/endpoints.py uses superuservalidators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session table...

CVE-2026-54754

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a...

piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

Summary piccoloadmin uses a helper called superuservalidators to gate access to the user and session tables for non-superusers. The helper rejects PUT, PATCH, DELETE, and POST, but does not reject GET. The sessions table stores live session tokens in plaintext, and the token column is not marked...

GHSA-2GH4-JMWQ-RR8W piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

Summary piccoloadmin uses a helper called superuservalidators to gate access to the user and session tables for non-superusers. The helper rejects PUT, PATCH, DELETE, and POST, but does not reject GET. The sessions table stores live session tokens in plaintext, and the token column is not marked...

CVE-2026-55485 Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccoloadmin/endpoints.py uses superuservalidators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session table...

CVE-2026-55485

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccoloadmin/endpoints.py uses superuservalidators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session table...

EUVD-2026-67858

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccoloadmin/endpoints.py uses superuservalidators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session table...

CVE-2026-55485 Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccoloadmin/endpoints.py uses superuservalidators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session table...