CVE-2026-72633 Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring
An authenticated user with read-only access can disable privilege monitoring, causing a silent loss of security data for operators.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72633?
CVE-2026-72633 is a medium-severity missing authorization vulnerability in Elastic Kibana, published on 1 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurring Privilege Monitoring engine task for a Kibana space. Privileged user monitoring then stops producing data for that space while the engine continues to report a healthy state to operators.
Weakness: CWE-863
Which versions are affected by CVE-2026-72633?
2 open source packages ship an affected version, including kibana and elk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kibana Bitnami | From 9.1.0 | 9.4.6, 9.5.2 |
elk Bitnami | From 9.1.0 | 9.4.6, 9.5.2 |
Products include Elastic Kibana.
How do I fix CVE-2026-72633?
Upgrade kibana to a fixed version for your release line: 9.4.6 or 9.5.2.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-72633 being exploited?
There is no known exploitation of CVE-2026-72633 in the wild and no public exploit code.
Other vulnerabilities in Elastic Kibana
Sources
Also known as BIT-elk-2026-72633, BIT-kibana-2026-72633, GHSA-g4vc-97c4-mfhw, MINI-5242-m5r8-5gf6, MINI-6m54-rmjh-92w7, MINI-7jrm-544x-gxg4 and 2 more.