CVE-2026-78606
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two authenticated principals originating from different authentication realms share the same username value, one could read, modify, and delete the other's private Elastic AI Assistant Knowledge Base entries.
Risk Assessment
The risk includes unauthorized access to private user data, potentially leading to confidentiality, integrity, and availability breaches.
Recommendation
Apply patches provided by Elastic and consider enforcing uniqueness of usernames across authentication realms.
Other vulnerabilities in Kibana
See all- CVE-2017-8452High
Kibana versions prior to 5.2.1 configured for SSL client access do not clean up file descriptors after certain requests, leading to accumulation over time until the process crashes.
- CVE-2016-1000219High
Kibana versions before 4.5.4 and 4.1.11, when a custom output is configured for logging, may write cookies and authorization headers to log files. This information could be used to hijack sessions of other users using Kibana behind some form of authentication such as Shield.
- CVE-2019-7609CriticalActively exploited
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that attempts to execute JavaScript code, potentially leading to arbitrary command execution with the permissions of the Kibana process on the host system.
- CVE-2026-82302High
Incorrect Authorization in Kibana can lead to unauthorized configuration modification via exploiting incorrectly configured access control security levels.
- CVE-2026-82299Medium
Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
- CVE-2026-82298Medium
Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
- CVE-2026-78596Medium
Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via Privilege Abuse (CAPEC-122). An authenticated user holding Security read-level access in a single Kibana space could trigger Entity Analytics migration operations that perform privileged writes across all Kibana spaces, regardless of that user's actual access scope.
- CVE-2026-78595Medium
Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent metadata and access diagnostic content belonging to agents enrolled in other Kibana spaces.
- CVE-2026-78593Medium
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond the caller's authorized Elasticsearch permissions.
- CVE-2026-78583High
Incorrect Authorization in Kibana can lead to privilege escalation via input data manipulation. Elasticsearch cluster privilege declarations from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents.
Original NVD description (English source)
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two authenticated principals originating from different authentication realms share the same username value, one could read, modify, and delete the other's private Elastic AI Assistant Knowledge Base entries.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS