CVE-2026-72630

HighCVSS 7.1/10Last modified Sep 2, 2026

Description

Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the integration recorded on the stored policy rather than against the replacement integration supplied with the update. An authenticated user holding only the Elastic Defend endpoint policy management privilege was therefore able to convert an endpoint policy they administer into a policy for a different integration, and to supply that integration's configuration at the same time.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Elastic	Kibana	>= 8.19.0, <= 8.19.19; >= 9.0.0, <= 9.4.4; 9.5.0

References

https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-127/389531Vendor Advisory

Timeline

Published: Aug 13, 2026
Last modified: Sep 2, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-726316.5Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integratio CVE-2026-726327.1Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsea CVE-2026-726334.3Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Prope CVE-2026-726366.5Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAP CVE-2026-726386.5Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated us CVE-2026-726396.5Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived CVE-2026-72646.3A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function get_cart_items of the file /admin/aj CVE-2026-726406.5The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manages, and it accepts th CVE-2026-726415.4Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrain CVE-2026-726428.8The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a CVE-2026-726437.1Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and fallin CVE-2026-726446.5Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holdin