CVE-2026-72675Disclosure(elastic / kibana)

LOWCVSS 7.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch elastic kibana systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep the machine learning data of one space separated from another. Part of the Machine Learning functionality did not apply that filter, so operations issued from one space were carried out against the machine learning data of every space in the deployment.

elastic CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-92/389526

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

kibana

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

elastic

Products

kibana

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Full discourse1 post

CyberSignal | Cybersecurity News@XQOPTRX46d
Disclosure
CyberSec Daily ✓ · 📊 SIEM security · August 13, 2026 🎯 High-severity Kibana flaw exposes machine-learning data across spaces Elastic disclosed CVE-2026-72675, a missing-authorization vulnerability in Kibana Machine Learning. A low-privileged user could potentially view or modify ML data belonging to other Kibana spaces. The issue affects Kibana 8.0.0–8.19.19 and 9.0.0–9.4.4. It is fixed in 8.19.20 and 9.4.5. Elastic says no workaround is available. 🔗 Source: Elastic security advisory #Kibana #ElasticSecurity #CVE202672675 #SIEM #SOC
Post summary
Elastic disclosed CVE‑2026‑72675, a missing‑authorization vulnerability in Kibana Machine Learning that lets low‑privileged users access or modify data across spaces; the flaw is fixed in newer releases.
0000037
59 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	elastic	kibana	-	-	-

Explore more

Back to dashboard elastic CVEs kibana vulnerabilities