← Back

CVE-2026-78601

nvd nist
Published: Sep 2, 2026Modified: Sep 3, 2026

JSON object

Loading...
5.5
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Exploitability: 1.2 / Impact: 4.2
Source: security@elastic.co (Secondary)

Description

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices that user is not authorized to access. Derived entity data from those indices is then exposed through the entity store output.

Affected (1)

Products: Elastic: Kibana
Elastic
1 product
Kibana
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Kibana
From 9.4.0 to 9.4.5

Related CWEs

CWE-862
Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (1)

Source: security@elastic.co
Vendor Advisory

Timeline

No history available yet.