CVE-2026-72641: CWE-863 Incorrect Authorization in Elastic Kibana

This vulnerability (CWE-863) in Kibana involves improper access control that permits users with limited read permissions to perform unauthorized state changes on Entity Store maintainer tasks. Specifically, an authenticated user holding Security Solution read access can enumerate and alter these tasks, which are intended to be restricted by ACLs. This can result in the silent disabling of Entity Analytics maintenance for the affected Kibana space, potentially degrading analytics functionality without detection.

The vulnerability allows unauthorized modification of internal maintenance tasks related to Entity Analytics, which can lead to the disabling of these maintenance operations. This impacts the availability and integrity of analytics data within the affected Kibana space. There is no direct confidentiality impact reported. The CVSS score of 5.4 (medium severity) reflects limited privileges required but significant impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Kibana spaces to trusted users only and monitor for unusual changes in Entity Store maintainer tasks. Avoid granting Security Solution read access to users who should not have the ability to affect maintenance tasks.