CVE-2026-72633: Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring
Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurring Privilege Monitoring engine task for a Kibana space. Privileged user monitoring then stops producing data for that space while the engine continues to report a healthy state to operators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with read-level access to the Kibana Security feature can exploit it, even if they have no Elasticsearch privileges. The impact is limited to the Kibana space where they can access the affected functionality.
What is the practical impact of exploitation?
The attacker can stop the recurring Privilege Monitoring engine task for a Kibana space. Privileged user monitoring stops generating data for that space, while the engine may still appear healthy to operators.
How can defenders identify whether they may be affected?
Review whether Privilege Monitoring data is continuing to be produced in each Kibana space. A healthy engine status alone is not sufficient evidence because the task can be stopped while the engine continues reporting a healthy state.