The vulnerability in Graylog's token revocation API allows any authenticated user with the USERS_TOKENREMOVE permission to delete tokens owned by other users, including service accounts or administrators. It does not expose the token contents but removes the token, causing integrity loss and potentially disabling token‑based integrations. The flaw is a classic authorization bypass (CWE‑639) where the API checks the requested userId before resolving the token and fails to verify that the token belongs to that user before destroying it.

Graylog Server versions from 6.2.0 up to but not including 6.3.12, and all 7.x releases prior to 7.0.7 and 7.1.2 remain vulnerable. The bug was fixed in Graylog 6.3.12, 7.0.7, and 7.1.2.

The CVSS score of 5.3 indicates moderate severity, and peak exploit probability (EPSS) is not available. The vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploit data. The likely attack vector requires an authenticated user who can assign the USERS_TOKENREMOVE permission; the attacker supplies a victim’s userId in the path, causing the target’s tokens to be deleted. Compromise of token holders can disrupt automated workflows and integrations but does not directly expose confidential data.