CVE-2026-72673

Summary: Kibana Synthetics private locations across multiple spaces are vulnerable to unauthorized deletion due to Incorrect Authorization (CWE-863). The ACL check only considered monitors in the requesting user’s own space, allowing a user with Synthetics write privilege in one space to delete a...

CVE-2026-72673

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Synthetics private locations can be shared with more than one space, and deleting one removes it from every space it is...

EUVD-2026-58260

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Synthetics private locations can be shared with more than one space, and deleting one removes it from every space it is...

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-124)

Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. ...

Kibana 9.4.5 Security Update (ESA-2026-89)

Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead o...

Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-127)

Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation Description: Incorrect Authorization CWE-863 in Kibana Fleet can lead to privilege escalation via Privilege Abuse CAPEC-122. Fleet restricts some callers to managing integration policies for one specific integration. When an...

Kibana 8.19.20, and 9.4.4 Security Update (ESA-2026-90)

Incorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private Locations Description: Incorrect Authorization CWE-863 in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1...

Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench

Summary Multiple vulnerabilities were addressed in IBM DevOps Solution Workbench version 5.2.1 Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS. By...

PT-2026-71783

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An incorrect authorization issue exists where functionality is not properly constrained by Access Control Lists ACLs. This allows an authenticated user with Synthetics write privileges in one...

PT-2026-71752

Name of the Vulnerable Software and Affected Versions Kibana Fleet affected versions not specified Description Incorrect Authorization in Kibana Fleet allows for privilege escalation through privilege abuse. The system restricts certain users to managing integration policies for a single specific...

CVE-2026-48416

CVE-2026-48416 affects Adobe Commerce with an Incorrect Authorization vulnerability (CWE-863) that could allow an attacker to bypass security controls and gain unauthorized read access. The issue reportedly requires no user interaction and has a CVSS v3.1 base score of 7.5 (HIGH) , with a network...

CVE-2026-48416 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction...

CVE-2026-48416 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction...

CVE-2026-48415

CVE-2026-48415 affects Adobe Commerce and describes an Incorrect Authorization vulnerability that allows a low-privileged attacker to bypass security measures, gaining unauthorized read and write access with limited impact on availability. Exploitation does not require user interaction. The conne...

CVE-2026-48415 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability...

CVE-2026-48415 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability...

CVE-2026-48411 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require use...

CVE-2026-48411

CVE-2026-48411 : Adobe Commerce is affected by an Incorrect Authorization vulnerability that could bypass security features, allowing a user with high privileges to gain unauthorized write access. Exploitation requires network access, is possible without user interaction, and has a CVSSv3.1 base ...

CVE-2026-48412 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to restricted resources. Exploitation of this issue does not require user interaction...

CVE-2026-48411 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require use...