CVE-2026-78581CWE-639

CVE-2026-78581

Medium · published August 25, 2026

CVSS v3.1
4.2
EPSS
0%
Percentile
9.7
In the wild
Unconfirmed
What it is

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00203 · 9.7th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-25T17:19Z
Affected products (2)
ProductVersionsFixed in
elastic/kibana≥ 8.0.0, < 8.16.38.16.3
elastic/kibana≥ 8.17.0, < 8.17.28.17.2
References (1)
https://discuss.elastic.co/t/kibana-8-16-3-8-17-2-security-update-esa-2026-51/387446 · [email protected]
EPSS history
Timeline
  • 27 AUG 06:46Z
    EPSS moved — → 0%
    epss
  • 25 AUG 13:08Z
    Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana
    cvelistv5