CVE-2026-72672

Summary: CVE-2026-72672 describes an incorrect authorization in Kibana that can disclose Elastic Defend endpoint event data. The root cause is that Elastic Security queries use Kibana’s internal Elasticsearch account, not the requesting user’s account, and only Kibana feature privileges are check...

CVE-2026-72672 Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the...

CVE-2026-72671 Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments

A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jo...

CVE-2026-72671

CVE-2026-72671 describes a missing authorization in Kibana’s Machine Learning feature that can allow an authenticated user with certain ML privileges to remove a trained model from a space without the trained-model privilege. The vulnerability affects Kibana ML capabilities that remove saved obje...

CVE-2026-72669 Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flow...

CVE-2026-72669

CVE-2026-72669 affects Kibana Observability Onboarding flow state handling where ownership is not enforced. The vulnerability allows an authenticated user with basic space access to view others’ onboarding flows, read their state, and write arbitrary progress data, potentially causing the owner’s...

CVE-2026-72681 Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure

Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information th...

CVE-2026-72681

CVE-2026-72681 affects Kibana, specifically the Kibana Agent Builder, where it fails to verify that a requester holds the privileges required by another Kibana feature before creating and running a tool that invokes that feature. This results in privilege escalation and potential disclosure of in...

EUVD-2026-58255

Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information th...

CVE-2026-72681

Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information th...

CVE-2026-72680

Summary: CVE-2026-72680 affects Kibana Agent Builder via the A2A JSON-RPC API. An authenticated user with only read privileges can supply a user-owned identifier for a conversation that already exists in the same space and cause that conversation to be replaced and reassigned to the attacker, res...

CVE-2026-72680 Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...

CVE-2026-59714

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

CVE-2026-73563

Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for...

EUVD-2026-58195

vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can chan...

CVE-2026-73652 vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can chan...

CVE-2026-73644 OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grant

OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java checked the PROXIEDAUTH privilege but did not evaluate the mayProxy proxy ACI scope when an...

CVE-2026-73644

OpenDJ is affected by a vulnerability in the SASL PLAIN authorization identity path prior to version 5.1.2. The issue occurs when an authenticated account with the PROXIED_AUTH privilege does not properly evaluate the mayProxy proxy ACI scope for an authzid that resolves to a different user, allo...

CVE-2026-58511

Webhook Authorization Header Returned in Plaintext via API...

CVE-2026-58432

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea...