CVE-2026-78606: Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two authenticated principals originating from different authentication realms share the same username value, one could read, modify, and delete the other's private Elastic AI Assistant Knowledge Base entries.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
The issue affects environments where two authenticated principals from different authentication realms have the same username value. It specifically exposes private Elastic AI Assistant Knowledge Base entries between those principals.
What access does an attacker need?
An attacker must be authenticated and use a principal from a different authentication realm that shares the target user's username. No user interaction is required.
What could an affected user do to another user's private entries?
They could read, modify, or delete the other principal's private Elastic AI Assistant Knowledge Base entries.