Skip to content
ElasticCVE-2026-78581

Elastic Kibana: insecure direct object reference

Medium4.2CVE-2026-78581 · Published Aug 25, 2026 · updated Sep 2, 2026

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.

Elastic advisory

Affected versions

PackageAffectedFixed in
Kibana
Product
>= 8.0.0, <= 8.16.2No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-639

More Elastic advisories

All Elastic
Advisory
Elastic Kibana: denial of service
Medium6.5Sep 1
Elastic Kibana: information disclosure
Medium6.5Sep 1
Elastic Kibana: improper authorization
High8.3Sep 1
Elasticsearch: denial of service
Medium4.9Sep 1
Elastic Kibana: denial of service
Medium6.5Sep 1
Elastic Security: denial of service
High7.2Sep 1

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.