CVE-2026-78595

4.3 Moyenne

Publiée le 03/09/2026 à 21:17 · Modifiée le 08/09/2026 à 16:17 · En attente d'analyse NVD · Source : security@elastic.co

Description

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent metadata and access diagnostic content belonging to agents enrolled in other Kibana spaces.

Traduire en français

Produits concernés

Elastic Kibana

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	security@elastic.co	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-862

Références

https://discuss.elastic.co/t/kibana-9-4-6-9-5-3-security-update-esa-2026-153/390160

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories