CVE-2026-78606 — MEDIUM (4.2)

Q: How severe is CVE-2026-78606?

CVE-2026-78606 has been rated MEDIUM with a CVSS base score of 4.2/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-78606?

Check the references section above for vendor advisories and patch information. Affected products include: Elastic Kibana.

Vulnerability Description

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two authenticated principals originating from different authentication realms share the same username value, one could read, modify, and delete the other's private Elastic AI Assistant Knowledge Base entries.

CVSS Score

4.2

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Elastic	Kibana	>= 8.19.11, < 8.19.21

Related Weaknesses (CWE)

CWE-863

References

https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026Vendor Advisory

FAQ

What is CVE-2026-78606?

CVE-2026-78606 is a vulnerability with a CVSS score of 4.2 (MEDIUM). Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two au...

How severe is CVE-2026-78606?

CVE-2026-78606 has been rated MEDIUM with a CVSS base score of 4.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-78606?

Check the references section above for vendor advisories and patch information. Affected products include: Elastic Kibana.