CVE-2026-72633

MediumCVSS 4.3/10Last modified Sep 4, 2026

Description

Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurring Privilege Monitoring engine task for a Kibana space. Privileged user monitoring then stops producing data for that space while the engine continues to report a healthy state to operators.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Sep 1, 2026
Last modified: Sep 4, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-726366.5Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAP CVE-2026-726386.5Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated us CVE-2026-726396.5Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived CVE-2026-72646.3A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function get_cart_items of the file /admin/aj CVE-2026-726406.5The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manages, and it accepts th CVE-2026-726415.4Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrain CVE-2026-726428.8The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a CVE-2026-726437.1Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and fallin CVE-2026-726446.5Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holdin CVE-2026-726456.5Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A CVE-2026-726476.5Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An aut CVE-2026-726486.5Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on Kubernetes (ECK) can lead to information