CVE-2026-78581

published 2026-08-25

CVE-2026-78581: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly…

Priority P4 23 medium 4.2 CVSS 3.1

AV N AC H PR L UI N S U C L I L A N

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
elastic	kibana	>= 8.0.0 < 8.16.3	8.16.3
elastic	kibana	8.0.0 – 8.16.2	—
elastic	kibana	>= 8.17.0 < 8.17.2	8.17.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-639