Skip to content
ElasticCVE-2026-78596

Elastic Kibana: missing authorization

Medium4.3CVE-2026-78596 · Published Sep 3, 2026 · updated Sep 8, 2026

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via Privilege Abuse (CAPEC-122). An authenticated user holding Security read-level access in a single Kibana space could trigger Entity Analytics migration operations that perform privileged writes across all Kibana spaces, regardless of that user's actual access scope.

Elastic advisory

Affected versions

PackageAffectedFixed in
Kibana
Product
>= 8.18.3, <= 8.19.20No fix yet
>= 9.0.3, <= 9.4.5No fix yet
>= 9.5.0, <= 9.5.2No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-862

More Elastic advisories

All Elastic
Advisory
Elastic Kibana: improper authorization
Medium4.3Sep 3
Elastic Kibana: improper authorization
Medium6.5Sep 3
Elastic Kibana: improper authorization
High8.1Sep 3
Elastic Kibana: improper authorization
High8.1Sep 3
Elastic Kibana: code injection
Medium4.3Sep 3
Elastic Kibana: missing authorization
Medium4.3Sep 3

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.