CVE-2026-72661
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Kibana has a missing authorization vulnerability (CWE-862) leading to information disclosure. An internal data retrieval capability used by Elastic Defend response actions did not enforce Security Solution and endpoint privileges, and retrieved data with elevated internal permissions. An authenticated low-privileged user with no Security Solution, endpoint, or Elasticsearch privileges could read endpoint response action records and response content from managed hosts.
Risk Assessment
The attack can expose sensitive information about response actions and host data, compromising confidentiality. Even users with minimal privileges can access this data.
Recommendation
Update Kibana to the patched version. Restrict access to internal functions and regularly audit privileges.
Original NVD description (English source)
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability used by Elastic Defend endpoint response actions did not enforce the Security Solution and endpoint privileges that its user-facing equivalents require, and it retrieved data with elevated internal permissions rather than the permissions of the requesting user. As a result, an authenticated low-privileged Kibana user with no Security Solution privileges, endpoint privileges and no Elasticsearch privileges on the underlying data, could read endpoint response action records and the corresponding response content returned by managed hosts.