CVE-2026-78597

4.3 Moyenne

Publiée le 01/09/2026 à 22:17 · Modifiée le 02/09/2026 à 20:50 · Analysée par le NVD · Source : security@elastic.co

Description

Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.

Traduire en français

Produits concernés

Elastic Kibana

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	security@elastic.co	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-862

Références

https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-security-update-esa-2026-155/390072 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories