Graylog Server API vulnerability exposes protected database fields

Graylog2/graylog2-server has addressed a security vulnerability in its API endpoint for retrieving system catalog entity titles, as detailed in the GitHub Security Advisory database. The issue allowed authenticated users to access protected database fields, such as password hashes, by crafting custom API requests. While permission checks limited access to one's own password hash, admin users could retrieve hashes for all users. This vulnerability has been classified as medium severity.

The issue has been resolved in Graylog version 7.1.4, which introduces an allow list to prevent access to protected fields via this endpoint. Users are advised to upgrade to version 7.1.4 or later, as no workarounds are available for this issue.

Operators planning the upgrade should ensure that all API integrations are compatible with the new allow list mechanism. Any custom scripts or tools relying on the affected endpoint may encounter errors if they attempt to access fields now restricted by the patch. Testing these integrations in a staging environment before upgrading is recommended to avoid disruptions.