Graylog’s System Catalog titles endpoint fails to verify that each requested field is readable, allowing an authenticated user to retrieve protected data such as password hashes. This flaw represents an information disclosure vulnerability (CWE‑213). The endpoint is accessible only after authentication, so an attacker must possess valid credentials to exploit it, but permission levels determine the breadth of data recoverable.

The vulnerability is present in Graylog2 server versions 7.1.0 through 7.1.4 and in 7.2.0‑alpha.2. Administrators can retrieve hashes for all users, while ordinary users are limited to their own permitted records. The issue is located in EntityTitleServiceImpl.java and was fixed in releases 7.1.4 and 7.2.0‑alpha.2.

The CVSS base score of 5 indicates a moderate severity. EPSS information is not available and the flaw is not listed in the CISA KEV catalog. Because the endpoint requires an authenticated session, exploitation is likely to rely on legitimate credentials; administrators can obtain all user hashes, increasing the potential damage.