Graylog2 Server contains a missing permission check on the POST /events/definitions/{definitionId}/duplicate endpoint. The missing check allows any authenticated user who has the low‑privilege eventdefinitions:create capability to duplicate any existing event definition. By duplicating an event definition, an attacker obtains the private configuration of that definition, including detection queries, aggregation thresholds, grouping fields, schedules and notification bindings. The vulnerability therefore provides unauthorized read access to internal monitoring configurations.

Graylog2 graylog2-server implementations released before the commit that adds the missing permission check (commit 46a2eeb) are affected. All unpatched versions, irrespective of minor release number, expose the duplicate endpoint to users with eventdefinitions:create.

The CVSS base score of 5.3 indicates a moderate severity level. The EPSS score is reported as < 1% and the vulnerability is not listed in CISA KEV, suggesting low current exploitation probability. Attackers require only an authenticated session with eventdefinitions/create rights; no code execution or privilege escalation is described. Based on the description, it is inferred that exploitation does not provide runtime code execution, but it does expose sensitive configuration that could aid subsequent attacks. The primary risk to the organization is the disclosure of internal monitoring logic, which may assist an adversary in planning further reconnaissance or covert operations.