GHSA-j769-9gv9-65gr: Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

Graylog has an IDOR vulnerability (insecure direct object reference, where an attacker can access resources belonging to other users by guessing or knowing their IDs) in its token revocation endpoint. Any authenticated user can delete access tokens (credentials that allow systems to authenticate without using passwords) belonging to other users, including administrator tokens, if they know the token's identifier, which could disrupt integrations and system access.