Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-78608

Missing Authorization in Kibana Leading to Information Disclosure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
elastic

Description

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to users holding APM or Fleet administrative privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Elastic Kibana

Default version status: unaffected

  • 7.14.0 to ≤ 7.17.29affected
  • 8.0.0 to ≤ 8.19.20affected
  • 9.0.0 to ≤ 9.4.5affected
  • 9.5.0 to ≤ 9.5.1affected

References