CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-72669

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flows of other users, read their onboarding state, and write arbitrary progress data into them. A tampered flow can also cause the owner's onboarding view to fail with a server error.

Score
7.6 high
Published
2026-08-13
Links
NVD · cve.org · Report wrong data

Matched ports (5)

PortPackageVersionStatusMaintainer
textproc/kibana91kibana919.1.10unaddressedelastic@FreeBSD.org
textproc/kibana92kibana929.2.8unaddressedelastic@FreeBSD.org
textproc/kibana93kibana939.3.8possibly backportedelastic@FreeBSD.org
textproc/kibana8kibana88.19.21fixed by updateelastic@FreeBSD.org
textproc/kibana94kibana949.4.7fixed by updateelastic@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>8.19.19</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>8.19.19</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The state that Kibana stores for an Observability Onboarding flow is
	not bound to the user who created the flow, and the routes that read
	and update that state do not verify ownership. An authenticated user
	who holds only generic read access to the space can therefore discover
	the onboarding flows of other users, read their onboarding state, and
	write arbitrary progress data into them. A tampered flow can also
	cause the owner's onboarding view to fail with a server error.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-72669</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-72669</url>
    </references>
    <dates>
      <discovery>2026-08-13</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>