CVE-2026-72650CWE-639

CVE-2026-72650

Medium · published August 14, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule execution telemetry that belongs to spaces the user is not authorized to access. The disclosed telemetry includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00344 · 26.7th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-14T00:17Z
Affected products (2)
ProductVersionsFixed in
elastic/kibana≥ 8.0.0, < 8.19.208.19.20
elastic/kibana≥ 9.0.0, < 9.4.59.4.5
References (1)
https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-105/389521 · [email protected]
EPSS history
Timeline
  • 13 AUG 19:13Z
    Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure
    cvelistv5