CVE-2026-72633

Awaiting Analysis Awaiting Analysis - Queue

Incorrect Authorization in Kibana Entity Analytics

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Elastic

Description

Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurring Privilege Monitoring engine task for a Kibana space. Privileged user monitoring then stops producing data for that space while the engine continues to report a healthy state to operators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-72633

EUVD

EUVD-2026-69566

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	From 9.1.0 (inc) to 9.4.5 (inc)
elastic	kibana	From 9.5.0 (inc) to 9.5.1 (inc)
elastic	kibana	9.4.6
elastic	kibana	9.5.2
elastic	kibana	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

CVE-2026-72633 is an Incorrect Authorization vulnerability in Kibana Entity Analytics. It allows an authenticated user with read-level Security feature access to stop the recurring Privilege Monitoring engine task for a Kibana space. This happens without needing Elasticsearch privileges or admin rights, leading to a loss of security monitoring while the system falsely reports a healthy state.

Detection Guidance

Check Kibana version using command: curl -X GET "localhost:5601/api/status" | grep version. If version is between 9.1.0-9.4.5 or 9.5.0-9.5.1, the system is vulnerable. Verify if Privilege Monitoring engine is running in Kibana space settings.

Impact Analysis

This vulnerability could allow unauthorized users to disable security monitoring for a Kibana space. This means privileged user activity might go undetected, potentially leading to unnoticed security breaches or compliance violations. The impact is limited to spaces where the Entity Analytics Privilege Monitoring engine is active.

Compliance Impact

This vulnerability could lead to non-compliance with regulations like GDPR or HIPAA by disabling security monitoring. Without proper monitoring, organizations may fail to detect unauthorized access or data breaches, violating requirements for continuous security oversight and audit trails.

Mitigation Strategies

Upgrade Kibana to version 9.4.6 or 9.5.2 or later. If upgrading is not possible, disable the Privilege Monitoring engine in Kibana space settings as a temporary measure until patching is feasible.

Hi! I’m here to help you understand CVE-2026-72633. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70