CVE-2026-72661: CWE-862 Missing Authorization in Elastic Kibana
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability used by Elastic Defend endpoint response actions did not enforce the Security Solution and endpoint privileges that its user-facing equivalents require, and it retrieved data with elevated internal permissions rather than the permissions of the requesting user. As a result, an authenticated low-privileged Kibana user with no Security Solution privileges, endpoint privileges and no Elasticsearch privileges on the underlying data, could read endpoint response action records and the corresponding response content returned by managed hosts.
AI Analysis
Technical Summary
This vulnerability (CWE-862) in Kibana arises from missing authorization checks in an internal data retrieval capability used by Elastic Defend endpoint response actions. Unlike user-facing functions, this internal function does not enforce Security Solution, endpoint, or Elasticsearch privileges, allowing an authenticated user with low privileges and no relevant permissions to read sensitive endpoint response action records and their content. The flaw is present in Kibana versions 8.12.0, 9.0.0, and 9.4.0. No official patch or remediation level has been published at this time, and there are no known exploits in the wild.
Potential Impact
An authenticated user with low privileges in Kibana can access sensitive endpoint response action data and response content that should be restricted. This leads to unauthorized information disclosure, impacting confidentiality. There is no indication of impact on integrity or availability. The vulnerability does not require user interaction and can be exploited remotely over the network.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Elastic's advisories for updates. In the meantime, restrict Kibana user privileges to trusted users only and consider limiting access to the affected versions until a fix is available.
CVE-2026-72661: CWE-862 Missing Authorization in Elastic Kibana
Description
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability used by Elastic Defend endpoint response actions did not enforce the Security Solution and endpoint privileges that its user-facing equivalents require, and it retrieved data with elevated internal permissions rather than the permissions of the requesting user. As a result, an authenticated low-privileged Kibana user with no Security Solution privileges, endpoint privileges and no Elasticsearch privileges on the underlying data, could read endpoint response action records and the corresponding response content returned by managed hosts.
CVSS v3.1
Score 6.5medium
Affected software
pkg:github/elastic/kibanaRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-862) in Kibana arises from missing authorization checks in an internal data retrieval capability used by Elastic Defend endpoint response actions. Unlike user-facing functions, this internal function does not enforce Security Solution, endpoint, or Elasticsearch privileges, allowing an authenticated user with low privileges and no relevant permissions to read sensitive endpoint response action records and their content. The flaw is present in Kibana versions 8.12.0, 9.0.0, and 9.4.0. No official patch or remediation level has been published at this time, and there are no known exploits in the wild.
Potential Impact
An authenticated user with low privileges in Kibana can access sensitive endpoint response action data and response content that should be restricted. This leads to unauthorized information disclosure, impacting confidentiality. There is no indication of impact on integrity or availability. The vulnerability does not require user interaction and can be exploited remotely over the network.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Elastic's advisories for updates. In the meantime, restrict Kibana user privileges to trusted users only and consider limiting access to the affected versions until a fix is available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- elastic
- Date Reserved
- 2026-08-10T11:17:45.102Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7e1a82bf8831d539b18316
Added to database: 08/13/2026, 19:26:58 UTC
Last enriched: 08/13/2026, 19:57:19 UTC
Last updated: 08/13/2026, 21:41:13 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.