CVE-2026-78603: Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting in the unauthorized disclosure of Fleet deployment metadata from the default Kibana space.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Kibana deployments using the default Kibana space are exposed if authenticated users have minimal Elasticsearch privileges. Those users may be able to bypass Kibana feature authorization and space access controls.
What does an attacker need to exploit it?
An attacker needs to be an authenticated user with minimal Elasticsearch privileges. No user interaction is required.
What information could be disclosed?
The issue can disclose Fleet deployment metadata from the default Kibana space. The provided information does not indicate exposure of data outside that metadata.