CVE-2026-72662: Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeline write privilege is required for modification and deletion.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated users who have the Timeline feature privilege in a Kibana space are affected by the authorization boundary failure for draft Timeline objects in that same space. The issue concerns access across users within a shared space.
What level of access is required to exploit it?
An attacker must be authenticated and granted the Timeline feature privilege in the target Kibana space. Timeline read access is enough to enumerate and disclose other users' draft Timeline objects; Timeline write access is required to modify or delete them.
What data or actions can be affected?
A user with Timeline read access can enumerate and read draft Timeline objects owned by other users in the same space. A user with Timeline write access can also modify or delete those objects.