CVE-2026-78606 — Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

CVE-2026-78606

Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data PUBLISHED

Description (CNA)

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two authenticated principals originating from different authentication realms share the same username value, one could read, modify, and delete the other's private Elastic AI Assistant Knowledge Base entries.

Affected (CNA)

Vendor / product	Versions
Elastic / Kibana	affected 8.19.11 through 8.19.20; affected 9.3.0 through 9.4.5; affected 9.5.0 through 9.5.1

CWE

CWE-863

References

https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-142/390093

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.