CVE-2026-78608: CWE-862 Missing Authorization in Elastic Kibana

CVE-2026-78608 is a missing authorization (CWE-862) vulnerability in Elastic Kibana. An internal APM integration function does not enforce authorization controls, allowing any authenticated Kibana user to read APM server credentials that should be restricted to users with APM or Fleet administrative privileges. This results in potential information disclosure via privilege abuse (CAPEC-122). The vulnerability affects Kibana versions 7.14.0, 8.0.0, 9.0.0, and 9.5.0. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No official fix or patch is currently documented.

The vulnerability allows any authenticated Kibana user to access sensitive APM server credentials that should be limited to users with administrative privileges for APM or Fleet. This unauthorized access can lead to information disclosure, potentially compromising the confidentiality of sensitive monitoring infrastructure credentials. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should restrict Kibana access to trusted users only and monitor for updates from Elastic. No vendor advisory indicates that the issue is already mitigated or requires no action.