CVE-2026-72675

Received Received - Intake

Missing Authorization in Kibana Leads to Data Disclosure

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep the machine learning data of one space separated from another. Part of the Machine Learning functionality did not apply that filter, so operations issued from one space were carried out against the machine learning data of every space in the deployment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72675

EUVD

EUVD-2026-58262

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	*
elastic	kibana	From 8.0.0 (inc) to 8.19.19 (inc)
elastic	kibana	From 9.0.0 (inc) to 9.4.4 (inc)
elastic	kibana	8.19.20
elastic	kibana	9.4.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-72675 is a Missing Authorization vulnerability in Kibana that allows unauthorized access to machine learning data across different spaces. Normally, Kibana's Machine Learning uses elevated permissions and space filters to separate data between spaces. A bug caused these filters to be ignored, letting operations from one space access or modify data in all spaces.

Detection Guidance

Detecting this vulnerability requires checking Kibana versions and reviewing Machine Learning space access logs. Verify installed versions with 'curl -X GET "http://localhost:5601/api/console/proxy?path=../api/status"' or check package managers like 'dpkg -l | grep kibana' or 'rpm -qa | grep kibana'. Monitor Elasticsearch logs for unauthorized cross-space Machine Learning operations.

Impact Analysis

This vulnerability could allow an attacker with access to one space to view or alter sensitive machine learning data in other spaces. This may lead to unauthorized data exposure, data corruption, or misuse of machine learning models across your Kibana deployment.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating compliance requirements for data protection and privacy. It may result in non-compliance with GDPR, HIPAA, or other regulations that mandate strict access controls and data segregation.

Mitigation Strategies

Upgrade Kibana to version 8.19.20 or 9.4.5 immediately. If upgrading is not possible, restrict access to Kibana and Elasticsearch endpoints, disable Machine Learning features, and monitor for suspicious cross-space data access patterns.

Hi! I’m here to help you understand CVE-2026-72675. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70