CVE-2026-78601: CWE-862 Missing Authorization in Elastic Kibana

This vulnerability (CWE-862) in Kibana 9.4.0 allows an authenticated user with elevated privileges to bypass authorization controls on a Kibana Entity Store configuration operation. As a result, the user can indirectly trigger a background task that reads from Elasticsearch indices beyond their authorization scope. The derived entity data from these indices is then exposed via the entity store output, causing information disclosure. The CVSS 3.1 base score is 5.5 (medium), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

An attacker with elevated Kibana privileges can access sensitive data from Elasticsearch indices they should not have permission to read. This leads to unauthorized information disclosure but does not affect data integrity or availability. The vulnerability requires authenticated access with high privileges, limiting the attack surface to trusted users with elevated rights.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict elevated Kibana privileges to trusted users only and monitor for unusual access patterns related to entity store operations. No official remediation or temporary fix has been published by Elastic at this time.