CVE-2026-78596: Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations
Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via Privilege Abuse (CAPEC-122). An authenticated user holding Security read-level access in a single Kibana space could trigger Entity Analytics migration operations that perform privileged writes across all Kibana spaces, regardless of that user's actual access scope.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker must be authenticated and have Security read-level access in at least one Kibana space. They do not need write access to every space affected by the operation.
What can an attacker change outside their assigned space?
They can trigger Entity Analytics migration operations that perform privileged writes across all Kibana spaces, bypassing the user’s normal space access scope. The stated impact is unauthorized modification of data; no confidentiality or availability impact is described.
How can administrators identify potentially exposed users?
Review authenticated accounts that have Security read-level access in any Kibana space and determine whether they can trigger Entity Analytics migration operations. Such accounts meet the access condition described for exploitation.