CVE-2026-78601

5.5 Moyenne

Publiée le 02/09/2026 à 17:17 · Modifiée le 03/09/2026 à 15:42 · Analysée par le NVD · Source : security@elastic.co

Description

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices that user is not authorized to access. Derived entity data from those indices is then exposed through the entity store output.

Traduire en français

Produits concernés

Elastic Kibana

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.5 Moyenne	security@elastic.co	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N`

Faiblesses (CWE)

CWE-862

Références

https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-147/390107 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories