Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not… (CVE-2026-78606)

This vulnerability in Kibana arises from improper authorization checks (CWE-863) where access control lists (ACLs) do not properly constrain functionality. Specifically, if two authenticated principals from different authentication realms have the same username, one can read, modify, or delete the other's private data in the Elastic AI Assistant Knowledge Base. The issue is related to accessing functionality not properly constrained by ACLs (CAPEC-1).

An attacker with low privileges and no user interaction required can exploit this vulnerability remotely to gain unauthorized read, write, and delete access to another user's private knowledge base entries in Kibana. This leads to confidentiality and integrity impacts but does not affect availability. The CVSS score is 4.2 (medium severity).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, organizations should review authentication realm configurations and user management to avoid username collisions across realms.