Graylog 5.0.7 → 7.1.0

Vulnerabilities fixed by this upgrade

• 7.3 GHSA-q9q2-3ppx-mwqf Stored Cross-Site Scripting via Files Plugin and API Browser
• 8.0 CVE-2025-46827 Session Takeover via Insufficient HTML Sanitization
• 5.7 CVE-2024-24823 Session fixation vulnerability through cookie injection
• high CVE-2024-24824 Instantiation of arbitrary classes triggered by API request
• medium CVE-2023-41045 Insecure source port usage for DNS queries

Breaking changes

None in the release notes.

Security changes

• security Fixes GHSA-w9wq-g358-3x8g: Privilege escalation via user creation and user permission/role updates in 7.0.13
• security Fixes CVE-2026-69190: Manager-to-Owner privilege escalation on saved searches and dashboards in 7.0.9
• security Fixes CVE-2026-55841: Fortigate syslog message parser can be exploited to modify or delete fields from the original message in 7.0.7
• security Fixes CVE-2026-55867: Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens in 7.0.7
• security Fixes CVE-2026-69190: Manager-to-Owner privilege escalation on saved searches and dashboards in 7.0.0
• security Fixes CVE-2026-55867: Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens in 7.0.0
• security Fixes CVE-2026-69190: Manager-to-Owner privilege escalation on saved searches and dashboards in 6.3.14
• security Fixes CVE-2026-55841: Fortigate syslog message parser can be exploited to modify or delete fields from the original message in 6.3.12
• security Fixes CVE-2026-55867: Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens in 6.3.12
• security Fixes CVE-2025-53106: Privilege escalation through API tokens in 6.2.4
• security Fixes GHSA-q9q2-3ppx-mwqf: Stored Cross-Site Scripting via Files Plugin and API Browser in 6.2.0
• security Fixes CVE-2025-30373: Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value in 6.1.9
• security Fixes CVE-2024-24823: Session fixation vulnerability through cookie injection in 5.2.4
• security Fixes CVE-2024-24824: Instantiation of arbitrary classes triggered by API request in 5.2.4
• security Fixes CVE-2024-24823: Session fixation vulnerability through cookie injection in 5.1.11
• security Fixes CVE-2024-24824: Instantiation of arbitrary classes triggered by API request in 5.1.11
• security Fixes CVE-2023-41044: Partial path traversal vulnerability in Support Bundle feature in 5.1.3
• security Fixes CVE-2023-41041: User session is still usable after logout in 5.1.3
• security Fixes CVE-2023-41045: Insecure source port usage for DNS queries in 5.1.3
• security Fixes CVE-2023-41041: User session is still usable after logout in 5.0.9
• security Fixes CVE-2023-41045: Insecure source port usage for DNS queries in 5.0.9

Every release in between