An improper access control vulnerability allows an authenticated user to impersonate another by altering the user identifier in the URL, exposing profiles, names, email addresses, internal identifiers, and activity timestamps. The flaw in the Graylog API means no object‑level authorization checks are performed on the /users/<id> endpoint, enabling disclosure of sensitive user information without proper permission verification.

Graylog’s Web Interface, version 2.2.3 from the producer Graylog, is affected by this vulnerability. No additional product or version data is listed.

The CVSS score of 7.1 places the flaw in the high severity range, yet the EPSS score of less than 1% indicates a very low likelihood of exploitation at present. The vulnerability is not cataloged in CISA’s KEV, suggesting no widespread exploitation reports. The attack vector requires a valid authenticated user who can construct the URL; thus, internal or compromised accounts pose the primary risk. Keeping the software up to date and restricting API access lowers exposure significantly.