CVE-2026-78582
published 2026-09-26CVE-2026-78582: Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.18%
7.6th percentile
Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that are shared into spaces they have no access to. Where a monitor is associated with a private location, the same operation also destroys the underlying Elastic Agent integration configuration without the authorization checks that Fleet would otherwise apply.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | 7.12.0 – 7.17.29 | — |
| elastic | kibana | 8.0.0 – 8.19.21 | — |
| elastic | kibana | 9.0.0 – 9.4.6 | — |
| elastic | kibana | 9.5.0 – 9.5.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Elastic Kibana up to 7.17.29/8.19.21/9.4.6/9.5.2 Fleet authorization
vuldb·2026-09-26·CVSS 6.5
CVE-2026-78582 [MEDIUM] Elastic Kibana up to 7.17.29/8.19.21/9.4.6/9.5.2 Fleet authorization
A vulnerability was found in Elastic Kibana up to 7.17.29/8.19.21/9.4.6/9.5.2 and classified as problematic. Affected is an unknown function of the component Fleet. Such manipulation leads to missing authorization.
This vulnerability is referenced as CVE-2026-78582. It is possible to launch the attack remotely. No exploit is available.
GHSA
Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
ghsa_unreviewed·2026-09-26
CVE-2026-78582 [MEDIUM] CWE-862 Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that are shared into spaces they have no access to. Where a monitor is associated with a private location, the same operation also destroys the underlying Elastic Agent integration configuration without the authorization checks that Fleet would otherwise apply.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-26
Published