CVE-2026-56152
EUVD-2026-4108701.07.2026, 17:16
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to view.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| elastic | endpoint_security | 8.6.0 ≤ 𝑥 < 8.19.13 |
| elastic | endpoint_security | 9.0.0 ≤ 𝑥 < 9.2.7 |
| elastic | endpoint_security | 9.3.0 ≤ 𝑥 < 9.3.2 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| elastic | kibana | 9.3.0 ≤ 𝑥 ≤ 9.3.1 | CNA |
| elastic | kibana | 8.6.0 ≤ 𝑥 ≤ 8.19.12 | CNA |
| elastic | kibana | 9.0.0 ≤ 𝑥 ≤ 9.2.6 | CNA |