6 matches found
CVE-2026-78601
Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task...
CVE-2026-78597
Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only low-privilege Security feature access could invoke an administrative operation tha...
CVE-2026-78597 Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation
Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only low-privilege Security feature access could invoke an administrative operation tha...
CVE-2026-78597 Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation
Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only low-privilege Security feature access could invoke an administrative operation tha...
EUVD-2026-69574
Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only low-privilege Security feature access could invoke an administrative operation tha...
CVE-2026-78597
Kibana 's Entity Store feature is affected by a Missing Authorization flaw (CWE-862) that allows an authenticated user with only low-privilege Security feature access to invoke an administrative operation, creating and persisting Elasticsearch API keys under the caller's identity while bypassing ...