CVE-2026-78603: CWE-862 Missing Authorization in Elastic Kibana

This vulnerability (CWE-862) in Kibana involves missing authorization checks that permit an authenticated user with limited Elasticsearch privileges to circumvent Kibana's feature authorization and space access controls. Exploiting this flaw can result in unauthorized disclosure of Fleet deployment metadata within the default Kibana space. The issue arises from incorrectly configured access control security levels, as categorized under CAPEC-180. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges but no user interaction. The vulnerability affects Kibana versions 9.0.0 and 9.5.0. No vendor advisory or patch information is currently provided.

An authenticated user with minimal Elasticsearch privileges can bypass Kibana's authorization mechanisms to access Fleet deployment metadata that should be restricted. This leads to information disclosure but does not impact integrity or availability. The impact is limited to confidentiality of specific metadata within the default Kibana space.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten Elasticsearch and Kibana access controls to limit user privileges and restrict access to sensitive metadata. Monitor vendor communications for updates on patches or official mitigations.