CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-72650

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule execution telemetry that belongs to spaces the user is not authorized to access. The disclosed telemetry includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters.

Score
4.3 medium
Published
2026-08-13
Links
NVD · cve.org · Report wrong data

Matched ports (5)

PortPackageVersionStatusMaintainer
textproc/kibana91kibana919.1.10unaddressedelastic@FreeBSD.org
textproc/kibana92kibana929.2.8unaddressedelastic@FreeBSD.org
textproc/kibana93kibana939.3.8possibly backportedelastic@FreeBSD.org
textproc/kibana8kibana88.19.21fixed by updateelastic@FreeBSD.org
textproc/kibana94kibana949.4.7fixed by updateelastic@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>8.19.20</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>8.19.20</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana
	can lead to information disclosure via Accessing Functionality Not
	Properly Constrained by ACLs (CAPEC-1). An authenticated user who is
	authorized to read alerting rules in a single Kibana space could
	retrieve alerting rule execution telemetry that belongs to spaces the
	user is not authorized to access. The disclosed telemetry includes
	rule identifiers, rule names, space identifiers, execution outcomes,
	timestamps, and execution counters.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-72650</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-72650</url>
    </references>
    <dates>
      <discovery>2026-08-13</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>