CVE-2026-72665

Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who is able to author and evaluate Elastic Security detection rules can cause response actions to be carried out against enrolled agents without holding the Osquery live query privileges or the Elastic Defend response action privileges that normally govern those capabilities. Depending on the response action involved, this can result in disclosure of information from the affected hosts or in unauthorized changes to their state.

Published 13 Aug 2026, 20:17 UTC Last modified 13 Aug 2026, 20:17 UTC

8.1

CVSS 3.1 HIGH base score CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack profile

The conditions required to exploit this vulnerability and its potential impact.

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability None

Exploitability2.8

Impact5.2

Affected products

Product applicability statements supplied with the NVD record.

NVD has not published structured affected-product data for this record.

Weakness classification

CWE categories help security teams group the underlying software weakness.

CWECWE-862

Source references

External advisories, patches and technical reports attached to this CVE record.

NVD National Vulnerability Database recordnvd.nist.gov 01 Technical reference security@elastic.co