Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 25 Aug 2026 13:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier. | |
| Title | Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana | |
| Weaknesses | CWE-639 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: elastic
Published:
Updated: 2026-08-25T13:08:11.520Z
Reserved: 2026-08-24T21:13:45.971Z
Link: CVE-2026-78581
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-25T13:19:31.120
Modified: 2026-08-25T13:19:31.120
Link: CVE-2026-78581
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses