CVE-2026-78606 Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data
Authenticated users from different realms with identical usernames can access, modify, or delete each other's private AI Assistant knowledge base entries.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-78606?
CVE-2026-78606 is a medium-severity missing authorization vulnerability in Elastic Kibana, published on 1 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two authenticated principals originating from different authentication realms share the same username value, one could read, modify, and delete the other's private Elastic AI Assistant Knowledge Base entries.
Weakness: CWE-863
Which versions are affected by CVE-2026-78606?
It affects 1 product.
Products include Elastic Kibana.
How do I fix CVE-2026-78606?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-78606 being exploited?
There is no known exploitation of CVE-2026-78606 in the wild and no public exploit code.
Other vulnerabilities in Elastic Kibana
Sources
Also known as GHSA-r25h-rqj8-hg2m, MINI-2524-qqvv-225f, MINI-v29c-r2c3-h95g, MINI-v9q8-6wcq-2h6h, MINI-vhr7-v6cv-r8gp.