Elk: Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification (CVE-2026-72675)

CVE-2026-72675 is a missing authorization vulnerability in Kibana Machine Learning where Elasticsearch operations are executed with elevated internal permissions. The system relies on a per-request space filter to segregate machine learning data by space, but part of the functionality failed to apply this filter, resulting in cross-space information disclosure and unauthorized data modification. This privilege abuse vulnerability allows an attacker with access to one space to perform operations affecting data in all spaces within the deployment.

An attacker with access to one Kibana space can access and modify machine learning data belonging to other spaces, violating data confidentiality and integrity boundaries. This can lead to unauthorized disclosure of sensitive information and unauthorized changes to data across multiple spaces in the Kibana deployment.

A patch is available for this vulnerability. Users should upgrade affected Kibana versions to fixed releases at or beyond 8.19.20 and 9.4.5. Since this is not a cloud service, remediation requires applying the official fix. No additional vendor advisory content was provided, so check the vendor's official security advisories for exact patch versions and instructions.