CVE-2026-72661

Received Received - Intake

Missing Authorization in Kibana Leads to Information Disclosure

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability used by Elastic Defend endpoint response actions did not enforce the Security Solution and endpoint privileges that its user-facing equivalents require, and it retrieved data with elevated internal permissions rather than the permissions of the requesting user. As a result, an authenticated low-privileged Kibana user with no Security Solution privileges, endpoint privileges and no Elasticsearch privileges on the underlying data, could read endpoint response action records and the corresponding response content returned by managed hosts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72661

EUVD

EUVD-2026-58272

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	*
elastic	kibana	8.19.19
elastic	kibana	9.3.8
elastic	kibana	9.4.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-72661 is a Missing Authorization vulnerability in Kibana where an internal data retrieval function used by Elastic Defend did not enforce proper user permissions. This allowed low-privileged authenticated users to access sensitive endpoint response action records and their content despite lacking required privileges.

Detection Guidance

Check Kibana version to confirm if it is affected. Run: curl -XGET 'http://localhost:5601/api/status' | grep version. If running 8.19.19, 9.3.8, or 9.4.4, the system is vulnerable.

Impact Analysis

An attacker with low-level Kibana access could read confidential endpoint response data, including sensitive information returned by managed hosts. This could lead to unauthorized data exposure or further exploitation of internal systems.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, potentially leading to data breaches. Organizations may face penalties under GDPR for unauthorized data exposure or HIPAA violations for compromised endpoint information.

Mitigation Strategies

Upgrade Kibana to the latest patched versions (8.19.19, 9.3.8, or 9.4.4) immediately. If upgrading is not possible, restrict network access to Kibana and monitor for unauthorized data access.

Hi! I’m here to help you understand CVE-2026-72661. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70