Vulnerability in Elastic Kibana

[ Description ]Official description

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeline write privilege is required for modification and deletion.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR25 Sep 2026CERTFR-2026-AVI-1228

  Multiple vulnerabilities in Elastic products Translated from French

  Multiple vulnerabilities have been discovered in Elastic products. Some of them allow an attacker to cause privilege escalation, remote denial of service and a breach of data confidentiality.

  CVE-2026-72662CVE-2026-94398CVE-2026-94396+8 more CVEs
• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3575

  Kibana: Multiple vulnerabilities Translated from German

  CVE-2026-78582CVE-2026-94400CVE-2026-72662+1 more CVEs

[ References ]References

• discuss.elastic.co/t/kibana-8-19-22-9-4-6-security-update-esa-2026-103/390679