Graylog token revocation endpoint vulnerability allows unauthorized token deletion

According to the GitHub Security Advisory database, Graylog versions prior to 6.3.12, 7.0.7, and 7.1.2 contain an insecure direct object reference (IDOR) vulnerability in the token revocation endpoint. This issue enables authenticated users to delete access tokens belonging to other users, including service account and administrator tokens, if they know or can guess a valid token identifier. While the vulnerability does not expose token contents, it can lead to integrity and availability impacts for systems relying on access token-based integrations.

Operators planning to upgrade should carefully review their audit logs for suspicious token deletion activity, especially if running Graylog Enterprise or Security editions. Audit log entries for token deletions begin with "access token deleted from user," which can help identify potential exploitation before patching. Additionally, integrations relying heavily on service account tokens should be tested post-upgrade to ensure functionality is restored, as unauthorized deletions may have disrupted critical workflows.