Elk: Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering (CVE-2026-72669)
Kibana contains a vulnerability where the Observability Onboarding flow state is not properly bound to the user who created it. Authenticated users with generic read access can view and modify onboarding flows of other users, potentially causing information disclosure and data tampering. Tampering with a flow may also cause server errors in the owner's onboarding view. This issue affects specific Kibana versions and has a high severity rating. A patch is available to address this vulnerability.
AI Analysis
Technical Summary
The vulnerability in Kibana (CVE-2026-72669) arises because the state stored for the Observability Onboarding flow is not user-specific, and the API routes that read or update this state do not verify user ownership. Consequently, any authenticated user with generic read access to the space can access onboarding flows created by other users, read their state, and write arbitrary progress data. This can lead to cross-user information disclosure and data tampering. Additionally, modifying the onboarding flow state can cause the original owner's onboarding view to fail with a server error. The issue affects Kibana versions >=8.9.0 and <8.19.19, and >=9.0.0 and <9.4.5. No CVSS score is provided, but the severity is rated high. A patch is available for this vulnerability.
Potential Impact
An authenticated user with generic read access can access and modify onboarding flow states belonging to other users. This leads to unauthorized information disclosure and data tampering. Tampering can also disrupt the onboarding experience for the original user by causing server errors. There is no indication of known exploits in the wild.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade Kibana to versions 8.19.19 or later, or 9.4.5 or later, where the issue is fixed. No additional mitigation steps are indicated by the vendor advisory.
Elk: Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering (CVE-2026-72669)
Description
Kibana contains a vulnerability where the Observability Onboarding flow state is not properly bound to the user who created it. Authenticated users with generic read access can view and modify onboarding flows of other users, potentially causing information disclosure and data tampering. Tampering with a flow may also cause server errors in the owner's onboarding view. This issue affects specific Kibana versions and has a high severity rating. A patch is available to address this vulnerability.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Kibana (CVE-2026-72669) arises because the state stored for the Observability Onboarding flow is not user-specific, and the API routes that read or update this state do not verify user ownership. Consequently, any authenticated user with generic read access to the space can access onboarding flows created by other users, read their state, and write arbitrary progress data. This can lead to cross-user information disclosure and data tampering. Additionally, modifying the onboarding flow state can cause the original owner's onboarding view to fail with a server error. The issue affects Kibana versions >=8.9.0 and <8.19.19, and >=9.0.0 and <9.4.5. No CVSS score is provided, but the severity is rated high. A patch is available for this vulnerability.
Potential Impact
An authenticated user with generic read access can access and modify onboarding flow states belonging to other users. This leads to unauthorized information disclosure and data tampering. Tampering can also disrupt the onboarding experience for the original user by causing server errors. There is no indication of known exploits in the wild.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade Kibana to versions 8.19.19 or later, or 9.4.5 or later, where the issue is fixed. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-kibana-2026-72669
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-72669"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- High
- Cvss Version
- null
Threat ID: 6a85b4aaacd9273b49250ee6
Added to database: 08/19/2026, 13:50:34 UTC
Last enriched: 08/19/2026, 14:02:33 UTC
Last updated: 08/19/2026, 23:52:01 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.