Improper access control in Graylog - CVE-2024-52506
Published: November 18, 2024 / Updated: June 25, 2026
Vulnerability identifier: #VU135304
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-52506
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Graylog
Affected software:
Graylog
Graylog
Detailed vulnerability description
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the reporting functionality when processing multiple concurrent report rendering requests. A remote user can trigger concurrent report rendering requests to disclose sensitive information.
The issue occurs when report renderings are requested at the same start time and the headless browser instance is reused, which can cause one user's report to be returned to another authorized user.
How to mitigate CVE-2024-52506
Install security update from vendor's website.