CVE-2026-78596
Received Received - Intake

Missing Authorization in Kibana Leading to Unauthorized Data Modification

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: Elastic

Description
Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via Privilege Abuse (CAPEC-122). An authenticated user holding Security read-level access in a single Kibana space could trigger Entity Analytics migration operations that perform privileged writes across all Kibana spaces, regardless of that user's actual access scope.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-04
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-78596
EUVD
EUVD-2026-70660

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
elastic kibana *
elastic kibana to 8.19.21 (exc)
elastic kibana to 9.4.6 (exc)
elastic kibana to 9.5.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Kibana is a missing authorization issue (CWE-862) that allows an authenticated user with Security read-level access in one Kibana space to perform privileged writes across all spaces. This happens during Entity Analytics migration operations, enabling privilege abuse (CAPEC-122) and unauthorized data modification.

Detection Guidance

Detect this vulnerability by checking Kibana versions against affected releases (8.19.20 or earlier, 9.4.5 or earlier up to 9.5.2). Use commands like 'curl -X GET http://localhost:5601/api/status' to check version. Monitor logs for unauthorized cross-space write operations during Entity Analytics migrations.

Impact Analysis

An attacker with limited access could escalate privileges and modify data they are not authorized to change. This could lead to data corruption, unauthorized access to sensitive information, or manipulation of system configurations without proper permissions.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized data modifications, potentially breaching confidentiality and integrity controls required by GDPR and HIPAA. It undermines access control and audit mechanisms central to these regulations.

Mitigation Strategies

Immediately review and restrict user access in Kibana to the minimum required privileges. Ensure users with Security read-level access cannot trigger Entity Analytics migration operations. Update Kibana to the latest patched version as soon as possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78596. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart