CVE-2026-56152

Analyzed Analyzed - Analysis Complete

Elastic Defend Incorrect Authorization Vulnerability

Publication date: 2026-07-01

Last updated on: 2026-07-06

Assigner: Elastic

Description

Incorrect Authorization (CWE-863) in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to view.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-06

Generated

2026-07-22

AI Q&A

2026-07-01

EPSS Evaluated

2026-07-20

NVD

CVE-2026-56152

EUVD

EUVD-2026-41087

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	endpoint_security	From 8.6.0 (inc) to 8.19.13 (exc)
elastic	endpoint_security	From 9.0.0 (inc) to 9.2.7 (exc)
elastic	endpoint_security	From 9.3.0 (inc) to 9.3.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

CVE-2026-56152 is a security vulnerability in Elastic Defend that involves incorrect authorization (CWE-863). This means that under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to view. The issue arises because some functionality is not properly constrained by Access Control Lists (ACLs), leading to unauthorized information disclosure.

Detection Guidance

There are no specific indicators of compromise or detection commands identified for this vulnerability.

Impact Analysis

This vulnerability can lead to unauthorized information disclosure, where a low-privileged user gains access to sensitive response action data within Elastic Defend. Although it does not allow modification or denial of service, the exposure of sensitive data could compromise security and privacy within affected deployments.

Compliance Impact

The vulnerability allows unauthorized information disclosure by enabling low-privileged authenticated users to access response action data they should not view. Such unauthorized data access could potentially impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to sensitive information.

However, the provided information does not explicitly describe the direct effects on compliance with these standards or any regulatory implications.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade Elastic Defend to versions 8.19.13, 9.2.7, or 9.3.2 or later, where the issue has been fixed.

There are no available workarounds for users unable to upgrade.

Hi! I’m here to help you understand CVE-2026-56152. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70