This vulnerability (CVE-2026-72650) in Elastic Kibana involves an authorization bypass through a user-controlled key (CWE-639). An authenticated user authorized to read alerting rules in a single Kibana space can retrieve alerting rule execution telemetry belonging to other spaces without proper access control enforcement. The leaked telemetry data includes sensitive metadata such as rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters. The issue affects Kibana versions 8.0.0 and 9.0.0. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An attacker with legitimate read access to alerting rules in one Kibana space can gain unauthorized visibility into alerting telemetry data from other spaces. This leads to information disclosure of alerting rule metadata and execution details that should be restricted, potentially aiding further reconnaissance or targeted attacks. The impact is limited to confidentiality as there is no integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user permissions to the minimum necessary and monitor for unusual access patterns. No official remediation or temporary fix has been published by Elastic.