Vulnerability in Elastic Kibana
CVE-2026-72655
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating User-Controlled Variables (CAPEC-77). Object attributes accepted by the case management API were not subject to the same authorization enforcement applied in the user interface, so a low-privileged user could alter case records they were only entitled to view.
Vulnerability class: Mass Assignment
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Elastic Kibana — versions 8.0.0, 9.0.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-72655?
- CVE-2026-72655 is a medium-severity vulnerability in Elastic Kibana, classified under Improperly Controlled Modification of Dynamically-Determined Object Attributes. CVSS score: 4.3/10. Published 2026-08-13.
- How severe is CVE-2026-72655?
- Medium severity. CVSS v3 base score is 4.3 out of 10.