Kibana 9.1.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-97 / ESA-2026-89)

The version of Kibana installed on the remote host is 9.1.x prior to 9.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-89 and ESA-2026-97 advisories. - The Elastic Security capability that suggests existing field values while a user authors endpoint polic...

Kibana 8.19.x < 8.19.20 / 9.x < 9.4.5 / 9.5.x < 9.5.1 Multiple Vulnerabilities (ESA-2026-126 / ESA-2026-127 / ESA-2026-129)

The version of Kibana installed on the remote host is 8.19.x prior to 8.19.20, 9.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-126, ESA-2026-127 and ESA-2026-129 advisories. - Incorrect Authorization CWE-863 in Kiba...

CVE-2026-72629

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. The result is disclosure of inference output from a trained model in a different space that the user is not authoriz...

CVE-2026-72629 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. The result is disclosure of inference output from a trained model in a different space that the user is not authoriz...

CVE-2026-72629

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. The result is disclosure of inference output from a trained model in a different space that the user is not authoriz...

EUVD-2026-58289

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. The result is disclosure of inference output from a trained model in a different space that the user is not authoriz...

CVE-2026-72629

The issue CVE-2026-72629 affects Kibana and allows Authorization Bypass Through User-Controlled Key (CWE-639), enabling unauthorized cross-space access to machine learning model behavior and impacting deployment operations. According to the Elastic advisory, affected versions span all 8.19.0–8.19...

Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-126)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models Description: Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly...

PT-2026-71751

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. The result is disclosure of inference output from a trained model in a different space that the user is not authoriz...

EUVD-2026-47584

Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management...

CVE-2026-63145

Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management...

CVE-2026-63262

CVE-2026-63262 affects Kibana with Missing Authorization (CWE-862), enabling unauthorized cross-space information disclosure via user-supplied input that bypasses space-level access control. CVSSv3.1 base score is 4.3 (Medium) with network attack vector and low privileges required. Details indica...

CVE-2026-63145

Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management...

CVE-2026-63145

Kibana Machine Learning (ML) functionality is affected by an Incorrect Authorization (CWE-863) vulnerability. A management endpoint performs only a coarse privilege check and does not verify that the requesting user has access to the specific ML job or notification resources referenced in the req...

CVE-2026-63145 Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise

Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management...

CVE-2026-33460 Incorrect Authorization in Kibana Fleet Leading to Information Disclosure

Incorrect Authorization CWE-863 in Kibana can lead to cross-space information disclosure via Privilege Abuse CAPEC-122. A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoin...

CVE-2026-28503

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the SyncViewSet.querysyncedfolder action in cookbook/views/api.py line 903 fetches a Sync object using getobjector404Sync, pk=pk without including space=request.space i...

CVE-2026-28503

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the SyncViewSet.querysyncedfolder action in cookbook/views/api.py line 903 fetches a Sync object using getobjector404Sync, pk=pk without including space=request.space i...

CVE-2026-28503 Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the SyncViewSet.querysyncedfolder action in cookbook/views/api.py line 903 fetches a Sync object using getobjector404Sync, pk=pk without including space=request.space i...

CVE-2026-28503

Tandoor Recipes CVE-2026-28503: Prior to version 2.6.0, SyncViewSet.query_synced_folder() uses get_object_or_404(Sync, pk=pk) without scoping to space, allowing cross-space IDOR where an admin in Space A could trigger syncs (Dropbox/Nextcloud/Local import) and view logs for Sync configurations in...