A vulnerability in the Graylog2 view update API allows authenticated users to hijack ownership of dashboards and saved searches, potentially leading to unauthorized data deletion or access control manipulation.

This flaw stems from improper authorization checks within the view update API. An attacker with standard edit permissions can manipulate a shareRequest parameter to grant themselves ownership of entities they do not own, effectively bypassing intended access restrictions.

The ability for a low-privileged user to assume ownership of critical logging dashboards or saved searches poses a significant risk to operational integrity. An attacker could delete audit-critical records or remove administrative access to sensitive log views, leading to potential data loss and the impairment of security monitoring capabilities. While the CVSS score of 6.3 reflects a moderate risk, the potential for unauthorized administrative actions within a security platform necessitates prompt remediation.

Immediate Action: Update the Graylog2 server to version 6.3.14, 7.0.9, or 7.1.4, depending on the current deployment branch.

Proactive Monitoring: Review audit logs for unusual ownership changes on saved searches or dashboards, particularly those initiated by non-administrative user accounts.

Compensating Controls: Restrict access to the API and administrative interfaces to trusted networks, and enforce the principle of least privilege by auditing existing user permissions within the Graylog environment.

Public Exploit Available: Unknown

Organizations utilizing Graylog2 should prioritize upgrading to the patched versions specified above to eliminate this authorization vulnerability. Given that this flaw allows for the manipulation of sensitive log management configurations, delaying the update increases the risk of internal sabotage or unauthorized access to critical security data.