CVE-2026-78596

4.3 Moyenne

Publiée le 03/09/2026 à 21:17 · Modifiée le 08/09/2026 à 16:17 · En attente d'analyse NVD · Source : security@elastic.co

Description

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via Privilege Abuse (CAPEC-122). An authenticated user holding Security read-level access in a single Kibana space could trigger Entity Analytics migration operations that perform privileged writes across all Kibana spaces, regardless of that user's actual access scope.

Traduire en français

Produits concernés

Elastic Kibana

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	security@elastic.co	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-862

Références

https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-154/390161

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories