CVE-2026-78608

MediumCVSS 6.5/10Last modified Sep 2, 2026

Description

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to users holding APM or Fleet administrative privileges.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Sep 1, 2026
Last modified
Sep 2, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-786095.4Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CVE-2026-78619.8Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code InjeCVE-2026-786108.4WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an auCVE-2026-786128.6WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated useCVE-2026-786138.6WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user withCVE-2026-786148.6WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user wiCVE-2026-786154.6A Reflected Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JaCVE-2026-786164.8A Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated admCVE-2026-786176.3WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker CVE-2026-786186.9A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single lCVE-2026-786199.8Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recoverCVE-2026-78628.6The Eupago Gateway For Woocommerce WordPress plugin before 4.7.2 does not properly restrict access to its refund request handler, allowing u