CVE-2026-72655
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Improperly controlled modification of dynamically-determined object attributes in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data. An authenticated user without case editing privileges can alter case records they are only entitled to view, because the case management API does not enforce the same authorization as the user interface.
Risk Assessment
A low-privileged user can modify case data, potentially leading to data integrity violations and privilege escalation in security processes.
Recommendation
Update Kibana to a patched version and ensure the case management API enforces the same authorization rules as the user interface. Conduct an audit of case permissions.
Original NVD description (English source)
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating User-Controlled Variables (CAPEC-77). Object attributes accepted by the case management API were not subject to the same authorization enforcement applied in the user interface, so a low-privileged user could alter case records they were only entitled to view.