Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by… (CVE-2026-72641)

This vulnerability (CWE-863) in Kibana arises from improper access control enforcement, enabling users with limited read permissions to access and alter functionality that should be restricted. Specifically, an authenticated user holding Security Solution read access can enumerate and change the state of Entity Store maintainer tasks, which disables Entity Analytics maintenance within that Kibana space without detection. The issue is classified under Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1).

The impact includes unauthorized modification of data related to Entity Analytics maintenance tasks, leading to potential disruption or loss of analytics functionality within affected Kibana spaces. There is no confidentiality impact, but integrity and availability are affected. The CVSS score is 5.4 (medium severity). No known exploits are reported in the wild.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to Kibana spaces to trusted users only and monitor for unusual changes to Entity Store maintainer tasks.