CVE-2026-56146 is an improper access control vulnerability in Kibana that permits low-privileged authenticated users, who normally have read-only access to the Security Solution, to modify Entity Analytics Watchlist configurations. Additionally, under specific deployment scenarios, these users may gain access to data outside their authorized permissions. The vulnerability is identified as CWE-863 and has a CVSS 3.1 vector indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impact without availability impact.

The vulnerability allows unauthorized modification of watchlist configurations by users who should only have read-only access, potentially leading to unauthorized changes in security monitoring configurations. Furthermore, it may result in limited information disclosure by enabling access to data beyond the user's authorized scope. There is no indication of availability impact or known exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. In the meantime, review and restrict user privileges to minimize exposure, ensuring that only trusted users have access to the Security Solution features.