PT-2026-71785

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Missing authorization in Kibana Machine Learning allows for cross-space information disclosure and unauthorized data modification. The system performs Elasticsearch operations using elevated...

CVE-2026-72675: Missing Authorization

Missing Authorization CWE-862 in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse CAPEC-122. Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to...

PT-2026-71751

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authorization bypass occurs due to a user-controlled key, allowing unauthorized cross-space access because functionality is not properly constrained by Access Control Lists ACLs. This issue...

CVE-2026-72629: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. The result is disclosure of inference output from a trained model in a different space that the user is not authoriz...

BIT-KIBANA-2026-63262 Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control...

BIT-KIBANA-2026-63145 Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise

Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management...

BIT-ELK-2026-63262 Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control...

BIT-ELK-2026-63145 Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise

Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management...

Kibana 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-70 / ESA-2026-73)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.4. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-70 and ESA-2026-73 advisories. - Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure v...

Authorization Bypass Through User-Controlled Key

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via user-supplied identifiers in the scheduled query result data. An attacker can...

Missing Authorization

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Missing Authorization via user-supplied input that circumvents space-level access control. An attacker can access sensitive...

EUVD-2026-47584

Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management...

EUVD-2026-47590

Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control...

CVE-2026-63262

Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control...

CVE-2026-63145

Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management...

CVE-2026-63262 Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control...

CVE-2026-63262

CVE-2026-63262 affects Kibana with Missing Authorization (CWE-862), enabling unauthorized cross-space information disclosure via user-supplied input that bypasses space-level access control. CVSSv3.1 base score is 4.3 (Medium) with network attack vector and low privileges required. Details indica...

CVE-2026-63262 Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control...

CVE-2026-63262

Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control...

Kibana 9.4.4 Security Update (ESA-2026-73)

Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control. Affected Versions: 9.4.x: All versions from 9.4.0 up to and...