The vulnerability in Kibana Fleet (CVE-2026-72630) arises from incorrect authorization logic (CWE-863) during updates to integration policies. Fleet enforces restrictions so that callers can manage policies only for a specific integration. However, when an existing integration policy is updated, the authorization check is incorrectly applied against the integration recorded on the stored policy instead of the replacement integration provided in the update request. This flaw allows an authenticated user with limited privileges (Elastic Defend endpoint policy management) to escalate privileges by converting an endpoint policy they administer into a policy for a different integration and supplying that integration's configuration simultaneously.

An authenticated user with Elastic Defend endpoint policy management privileges can escalate their privileges by modifying integration policies beyond their intended scope. This could lead to unauthorized configuration changes in integrations other than those they are permitted to manage, potentially compromising system integrity or security posture.

A patch is available for this vulnerability. Users should upgrade Kibana Fleet to a fixed version beyond the affected ranges. Specifically, versions >=8.19.0 and <8.19.20, >=9.0.0 and <9.4.5, and >=9.5.0 and <9.5.1 are vulnerable. Upgrading to versions 8.19.20 or later, 9.4.5 or later, and 9.5.1 or later respectively will remediate the issue. No additional mitigation steps are indicated.