Is CVE-2026-65011 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-65011?

CVE-2026-65011 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-65011

Description

Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/{definitionId}/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private event definitions including detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings by duplicating them.