Graylog2 Server before commit 46a2eeb contains a missing authorization check on the POST /events/definitions/{definitionId}/duplicate endpoint. This allows authenticated users who have the eventdefinitions:create privilege, which is considered low-privilege, to duplicate any event definition regardless of ownership or permission. By duplicating event definitions, attackers can read private information such as detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings. This vulnerability exposes sensitive configuration data that should be restricted. The CVSS 4.0 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required.

Authenticated users with low-privilege eventdefinitions:create capability can bypass intended access controls to clone and read private event definitions. This exposure includes sensitive detection logic and notification configurations, potentially aiding further attacks or information disclosure within the Graylog2 environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the eventdefinitions:create capability to trusted users only to minimize risk. Monitor vendor communications for updates or patches addressing this missing authorization check.