AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ElasticCVE-2026-72641

Elastic Kibana: improper authorization

Elastic

CVE-2026-72641 · Published Sep 1, 2026 · updated Sep 2, 2026

Medium5.4
No fix yet
Elastic advisory

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store maintainer tasks, silently disabling Entity Analytics maintenance for that space.

Affected versions

PackageAffectedFixed in
Kibana
Product
>= 9.4.0, <= 9.4.5No fix yet
<= 9.5.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-863

More Elastic advisories

All Elastic
Medium 5.4Sep 1Elasticsearch: missing authorizationCVE-2026-78607no fix yetMedium 6.5Sep 1Elastic Kibana: missing authorizationCVE-2026-78608no fix yetHigh 7.3Sep 1Elastic Kibana: path traversalCVE-2026-78592no fix yetMedium 4.3Sep 1Elastic Kibana: missing authorizationCVE-2026-78597no fix yetMedium 4.3Sep 1Elastic Kibana: missing authorizationCVE-2026-78603no fix yetMedium 5.9Sep 1Elasticsearch: request smugglingCVE-2026-78605no fix yet