Skip to content
ElasticCVE-2026-56146

Elastic Kibana: improper access control

Medium5.4CVE-2026-56146 · Published Jul 21, 2026 · updated Aug 6, 2026

Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that should require elevated privileges. Under specific deployment conditions, this could also allow such a user to access data beyond their authorized scope.

Elastic advisory

Affected versions

PackageAffectedFixed in
Kibana
Product
>= 9.4.0, <= 9.4.2No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-863

More Elastic advisories

All Elastic
Advisory
Elastic Kibana: improper authorization
Medium5.0Jul 21
Elastic Kibana: missing authorization
Medium4.3Jul 21
Elasticsearch: denial of service
Medium6.5Jul 21
Elastic Kibana: improper authorization
Medium4.3Jul 21
Elastic Kibana: information disclosure
Medium4.3Jul 21
Elastic Kibana: resource exhaustion
Medium6.5Jul 21

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.