CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-72675

Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep the machine learning data of one space separated from another. Part of the Machine Learning functionality did not apply that filter, so operations issued from one space were carried out against the machine learning data of every space in the deployment.

Score
7.1 high
Published
2026-08-13
Links
NVD · cve.org · Report wrong data

Matched ports (5)

PortPackageVersionStatusMaintainer
textproc/kibana91kibana919.1.10unaddressedelastic@FreeBSD.org
textproc/kibana92kibana929.2.8unaddressedelastic@FreeBSD.org
textproc/kibana93kibana939.3.8possibly backportedelastic@FreeBSD.org
textproc/kibana8kibana88.19.21fixed by updateelastic@FreeBSD.org
textproc/kibana94kibana949.4.7fixed by updateelastic@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>8.19.20</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>8.19.20</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Missing Authorization (CWE-862) in Kibana can lead to cross-space
	information disclosure and unauthorized data modification via
	Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its
	Elasticsearch operations with elevated internal permissions and relies
	on a per-request space filter to keep the machine learning data of one
	space separated from another. Part of the Machine Learning
	functionality did not apply that filter, so operations issued from one
	space were carried out against the machine learning data of every
	space in the deployment.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-72675</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-72675</url>
    </references>
    <dates>
      <discovery>2026-08-13</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>