CVE-2026-78606: CWE-863 Incorrect Authorization in Elastic Kibana

This vulnerability (CWE-863) in Elastic Kibana arises from improper access control enforcement when two authenticated principals from different authentication realms share the same username. It enables unauthorized disclosure, modification, and deletion of private Elastic AI Assistant Knowledge Base entries by exploiting functionality not properly constrained by ACLs (Access Control Lists). The issue affects Kibana versions 8.19.11, 9.3.0, and 9.5.0. No official patch or remediation level has been provided by the vendor at this time.

An attacker authenticated in one realm but sharing a username with a user in another realm can access and manipulate the other user's private knowledge base entries. This leads to unauthorized data disclosure and integrity loss but does not affect availability. The CVSS vector indicates a network attack vector with high attack complexity and low privileges required, resulting in limited confidentiality and integrity impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider isolating authentication realms or enforcing unique usernames across realms to mitigate unauthorized cross-realm access. Monitor vendor communications for updates on patches or official mitigations.