CVE-2026-72680

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana92</name>
	<range><lt>9.4.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier
	of a stored conversation from a user-supplied input, and the ownership
	check on that identifier does not distinguish between a conversation
	that does not exist and one that exists but belongs to another user.
	As a result, an authenticated user holding only the Agent Builder read
	privilege can supply an identifier already in use by another user in
	the same space and cause that user's conversation to be replaced and
	reassigned to the requesting account. The original owner permanently
	loses access to the conversation and its history. The impact is
	limited to loss of integrity and availability of the affected
	conversation; the attacker does not read the overwritten content.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-72680</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-72680</url>
    </references>
    <dates>
      <discovery>2026-08-13</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>