CVE-2026-78598: CWE-863 Incorrect Authorization in Elastic Kibana

This vulnerability (CVE-2026-78598) involves incorrect authorization (CWE-863) in Elastic Kibana's machine learning feature. An authenticated user with machine learning job management privileges scoped to a single Kibana space can exploit improperly configured access control to make a job's saved object accessible across all spaces in the Kibana instance. This occurs despite the user lacking access rights to those additional spaces, leading to potential information disclosure. The issue affects Kibana versions 8.0.0, 9.0.0, and 9.4.0. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impact without availability impact. No patch or official remediation level has been published by Elastic as of the data provided.

An authenticated user with machine learning job management privileges in a single Kibana space can cause saved objects related to jobs to become accessible across all Kibana spaces, potentially exposing information that the user is not authorized to access. This leads to limited confidentiality and integrity impact but does not affect availability. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict machine learning job management privileges carefully and monitor access controls to limit exposure. Avoid granting these privileges broadly across users or spaces.