CVE-2026-72675
published 2026-08-13CVE-2026-72675: Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122)…
PriorityP339high7.1CVSS 3.1
AVNACLPRLUINSUCHILAN
EPSS
0.31%
22.8th percentile
Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep the machine learning data of one space separated from another. Part of the Machine Learning functionality did not apply that filter, so operations issued from one space were carried out against the machine learning data of every space in the deployment.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | >= 8.0.0 < 8.19.20 | 8.19.20 |
| elastic | kibana | 8.0.0 – 8.19.19 | — |
| elastic | kibana | >= 9.0.0 < 9.4.5 | 9.4.5 |
| elastic | kibana | 9.0.0 – 9.4.4 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Elastic Kibana up to 8.19.19/9.4.4 Machine Learning authorization (EUVD-2026-58262)
vuldb·2026-08-13·CVSS 7.1
CVE-2026-72675 [HIGH] Elastic Kibana up to 8.19.19/9.4.4 Machine Learning authorization (EUVD-2026-58262)
A vulnerability classified as critical has been found in Elastic Kibana up to 8.19.19/9.4.4. This vulnerability affects unknown code of the component Machine Learning. The manipulation leads to missing authorization.
This vulnerability is listed as CVE-2026-72675. The attack may be initiated remotely. There is no available exploit.
It is recommended to upgrade the affected component.
GHSA
Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122).
ghsa_unreviewed·2026-08-13
CVE-2026-72675 [HIGH] CWE-862 Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122).
Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep the machine learning data of one space separated from another. Part of the Machine Learning functionality did not apply that filter, so operations issued from one space were carried out against the machine learning data of every space in the deployment.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-13
Published