EUVD-2026-69571

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting ...

CVE-2026-78603

Missing Authorization (CWE-862) in Kibana allows an authenticated user with minimal Elasticsearch privileges to bypass feature authorization and space access controls , leading to unauthorized disclosure of Fleet deployment metadata from the default Kibana space. The vulnerability leverages incor...