CVE-2026-72630: CWE-863 Incorrect Authorization in Elastic Kibana
Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the integration recorded on the stored policy rather than against the replacement integration supplied with the update. An authenticated user holding only the Elastic Defend endpoint policy management privilege was therefore able to convert an endpoint policy they administer into a policy for a different integration, and to supply that integration's configuration at the same time.
AI Analysis
Technical Summary
This vulnerability (CWE-863) in Kibana Fleet arises from improper authorization checks during integration policy updates. When updating an existing integration policy, the system evaluates restrictions against the original stored integration instead of the new integration provided in the update request. As a result, an authenticated user with limited privileges for managing Elastic Defend endpoint policies can escalate privileges by converting their managed endpoint policy into a policy for another integration and applying that integration's configuration.
Potential Impact
An authenticated user with Elastic Defend endpoint policy management privileges can escalate their privileges by modifying policies beyond their authorized scope. This could lead to unauthorized configuration changes in other integrations, potentially impacting system security and integrity. The vulnerability has a CVSS 3.1 score of 7.1 (high severity) with high confidentiality impact, low integrity impact, and no availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor Elastic's advisories for updates and apply patches once available.
CVE-2026-72630: CWE-863 Incorrect Authorization in Elastic Kibana
Description
Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the integration recorded on the stored policy rather than against the replacement integration supplied with the update. An authenticated user holding only the Elastic Defend endpoint policy management privilege was therefore able to convert an endpoint policy they administer into a policy for a different integration, and to supply that integration's configuration at the same time.
CVSS v3.1
Score 7.1high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-863) in Kibana Fleet arises from improper authorization checks during integration policy updates. When updating an existing integration policy, the system evaluates restrictions against the original stored integration instead of the new integration provided in the update request. As a result, an authenticated user with limited privileges for managing Elastic Defend endpoint policies can escalate privileges by converting their managed endpoint policy into a policy for another integration and applying that integration's configuration.
Potential Impact
An authenticated user with Elastic Defend endpoint policy management privileges can escalate their privileges by modifying policies beyond their authorized scope. This could lead to unauthorized configuration changes in other integrations, potentially impacting system security and integrity. The vulnerability has a CVSS 3.1 score of 7.1 (high severity) with high confidentiality impact, low integrity impact, and no availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor Elastic's advisories for updates and apply patches once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- elastic
- Date Reserved
- 2026-08-10T11:17:29.887Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7e1a7fbf8831d539b180e3
Added to database: 08/13/2026, 19:26:55 UTC
Last enriched: 08/13/2026, 19:56:21 UTC
Last updated: 08/13/2026, 20:41:59 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.