CVE-2026-72633: CWE-863 Incorrect Authorization in Elastic Kibana

This vulnerability (CWE-863) in Kibana's Entity Analytics permits an authenticated user with limited read-level access to halt the Privilege Monitoring engine task in a Kibana space. The task stoppage results in a loss of security monitoring data for that space, although the engine continues to report a healthy status, potentially misleading operators. The issue arises from improper access control enforcement allowing functionality to be accessed without proper authorization.

An attacker with read-level Security feature access but no Elasticsearch privileges can stop the Privilege Monitoring engine task for a Kibana space. This leads to a loss of monitoring data for privileged user activities in that space, potentially reducing visibility into security events. However, the engine continues to report a healthy state, which may cause operators to be unaware of the monitoring failure. There is no direct impact on confidentiality or availability, but integrity of monitoring is affected.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict read-level Security feature access to trusted users only and monitor for unusual task stoppages in Kibana spaces if possible.