VULNERABILITY INTELLIGENCE

CVE-2026-78606

CVSS score4.2 MEDIUM
EPSS probability0.23%
CISA KEVNot currently listed
Published2026-09-01
Last modified2026-09-02
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Description

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two authenticated principals originating from different authentication realms share the same username value, one could read, modify, and delete the other's private Elastic AI Assistant Knowledge Base entries.

Weakness classification

  • security@elastic.co: CWE-863

Primary references