CVE-2026-78603 — Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata

CVE-2026-78603

Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata PUBLISHED

Description (CNA)

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting in the unauthorized disclosure of Fleet deployment metadata from the default Kibana space.

Affected (CNA)

Vendor / product	Versions
Elastic / Kibana	affected 9.0.0 through 9.4.5; affected 9.5.0

CWE

CWE-862

References

https://discuss.elastic.co/t/kibana-9-4-6-9-5-1-security-update-esa-2026-149/390069

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.