CVE-2026-72633: CWE-863 Incorrect Authorization in Elastic Kibana

This vulnerability (CWE-863) in Kibana's Entity Analytics permits an authenticated user with limited read-level access to halt the Privilege Monitoring engine task for a Kibana space. As a result, monitoring data for privileged users stops, but the monitoring engine continues to report a healthy status, potentially misleading operators about the security posture. The issue arises from improper access control enforcement on the functionality to stop the monitoring task. No Elasticsearch privileges are required to exploit this flaw.

The impact is a loss of security monitoring visibility for privileged users within a Kibana space. Although no confidentiality or availability impact is directly indicated, the integrity of monitoring data is compromised, which could delay detection of privilege misuse or other security incidents. The monitoring engine falsely reports a healthy state, potentially causing operators to overlook the lack of monitoring data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict read-level Security feature access to trusted users only and monitor for unusual activity related to the Privilege Monitoring engine task. Follow any official Elastic guidance when published.