CVE-2026-78601CWE-862broken-access-control

CVE-2026-78601

Medium · published September 2, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
27.2
In the wild
Unconfirmed
What it is

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices that user is not authorized to access. Derived entity data from those indices is then exposed through the entity store output.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00349 · 27.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-02T19:17Z
Affected products (1)
ProductVersionsFixed in
elastic/kibana≥ 9.4.0, < 9.4.59.4.5
References (1)
https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-147/390107 · [email protected]
EPSS history
Timeline
  • 04 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 02 SEP 14:43Z
    Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure
    cvelistv5