1. Home
  2. CVE Database
  3. CVE-2026-78603
MEDIUM · 4.3

CVE-2026-78603

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Ela...

Vulnerability Description

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting in the unauthorized disclosure of Fleet deployment metadata from the default Kibana space.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
ElasticKibana>= 9.0.0, < 9.4.6

Related Weaknesses (CWE)

CWE-862

References

FAQ

What is CVE-2026-78603?

CVE-2026-78603 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Ela...

How severe is CVE-2026-78603?

CVE-2026-78603 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-78603?

Check the references section above for vendor advisories and patch information. Affected products include: Elastic Kibana.