ElasticCVE-2026-72650
Elastic Kibana: information disclosure
Medium4.3CVE-2026-72650 · Published Aug 13, 2026 · updated Sep 2, 2026
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule execution telemetry that belongs to spaces the user is not authorized to access. The disclosed telemetry includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Kibana Product | >= 8.0.0, <= 8.19.19 | No fix yet |
| >= 9.0.0, <= 9.4.4 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-639
More Elastic advisories
All Elastic| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 13 | Elasticsearch: denial of service | Medium6.5 | No fix yet |
| Aug 13 | A flaw in Elasticsearch | Medium4.3 | No fix yet |
| Aug 13 | Elasticsearch: denial of service | Medium6.5 | No fix yet |
| Aug 13 | Elasticsearch: denial of service | Medium6.5 | No fix yet |
| Aug 13 | Elastic Kibana: denial of service | Medium6.5 | No fix yet |
| Aug 13 | Elastic Kibana: missing authorization | High7.1 | No fix yet |