Graylog2 Server before commit 46a2eeb has a missing authorization check in the endpoint that duplicates event definitions. Authenticated users possessing the eventdefinitions:create capability, even with low privileges, can exploit this to clone any event definition, including private ones. This unauthorized duplication exposes sensitive configuration data related to event detection and notification mechanisms. The vulnerability affects versions up to 7.1.5 and 7.0.10. No official patch or remediation level has been documented in the provided data.

An attacker with authenticated access and the eventdefinitions:create capability can bypass intended access controls to duplicate and thereby read private event definitions. This exposure includes sensitive detection queries and notification configurations, potentially aiding further reconnaissance or attack planning. The vulnerability does not allow privilege escalation or code execution but compromises confidentiality of event definition data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the eventdefinitions:create capability to trusted users only to minimize exposure. Monitor for updates from Graylog2 regarding patches or official mitigations.