CVE-2026-78597: CWE-862 Missing Authorization in Elastic Kibana

This vulnerability (CWE-862) in Kibana's Entity Store feature involves missing authorization checks that permit an authenticated user with low-privilege Security feature access to invoke administrative functions. Specifically, the user can create and persist Elasticsearch API keys under their own identity, circumventing the required elevated cluster and Kibana privileges normally enforced by the Entity Store setup flow. The vulnerability is identified in Kibana versions 8.0.0 and 9.0.3. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges but no user interaction, impacting confidentiality with no integrity or availability impact. No official patch or remediation information is currently provided, and there are no known exploits in the wild.

An attacker with low-privilege authenticated access to Kibana can create Elasticsearch API keys without proper authorization, potentially enabling unauthorized access to Elasticsearch resources under the attacker's identity. This could lead to limited confidentiality impact by exposing credentials or access tokens. There is no reported impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict low-privilege user access to the Kibana Security feature and monitor for unusual API key creation activities. Follow Elastic's advisories for updates on patches or workarounds.