CVE-2026-72650: Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule execution telemetry that belongs to spaces the user is not authorized to access. The disclosed telemetry includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72650?
The severity of CVE-2026-72650 is classified as medium with a score of 4.3.
How does CVE-2026-72650 affect Kibana?
CVE-2026-72650 allows an authenticated user to bypass authorization and access information that should be restricted.
What are the potential risks associated with CVE-2026-72650?
The potential risk of CVE-2026-72650 is information disclosure from accessing functionality not properly constrained by ACLs.
Who is affected by CVE-2026-72650?
CVE-2026-72650 affects authenticated users who can read alerting rules in a Kibana space.
How do I mitigate CVE-2026-72650?
To mitigate CVE-2026-72650, ensure that the access controls are properly configured to restrict unauthorized functionality.