Kibana Missing Auth: Unauthorized Data Mod via Space Migration
CVE-2026-78596 Published on September 3, 2026
Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations
Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via Privilege Abuse (CAPEC-122). An authenticated user holding Security read-level access in a single Kibana space could trigger Entity Analytics migration operations that perform privileged writes across all Kibana spaces, regardless of that user's actual access scope.
Vulnerability Analysis
CVE-2026-78596 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-78596 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-78596
Want to know whenever a new CVE is published for Elastic Kibana? stack.watch will email you.
Affected Versions
Elastic Kibana:- Version 8.18.3, <= 8.19.20 is affected.
- Version 9.0.3, <= 9.4.5 is affected.
- Version 9.5.0, <= 9.5.2 is affected.