CVE-2026-72662
published 2026-09-26CVE-2026-72662: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing…
PriorityP337medium6.3CVSS 3.1
AVNACLPRLUINSUCLILAL
EPSS
0.17%
6.3th percentile
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeline write privilege is required for modification and deletion.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | 8.0.0 – 8.19.21 | — |
| elastic | kibana | 9.4.0 – 9.4.5 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACL
ghsa_unreviewed·2026-09-26
CVE-2026-72662 [MEDIUM] CWE-639 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACL
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeline write privilege is required for modification and deletion.
VulDB
Elastic Kibana up to 8.19.21/9.4.5 Timeline feature authorization
vuldb·2026-09-26·CVSS 6.3
CVE-2026-72662 [MEDIUM] Elastic Kibana up to 8.19.21/9.4.5 Timeline feature authorization
A vulnerability, which was classified as critical, was found in Elastic Kibana up to 8.19.21/9.4.5. This affects an unknown function of the component Timeline feature. The manipulation results in authorization bypass.
This vulnerability was named CVE-2026-72662. The attack may be performed from remote. There is no available exploit.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-26
Published