CVE details
CVE-2026-78603
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting in the unauthorized disclosure of Fleet deployment metadata from the default Kibana space.
Matched ports (4)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| textproc/kibana91 | kibana91 | 9.1.10 | unaddressed | elastic@FreeBSD.org |
| textproc/kibana92 | kibana92 | 9.2.8 | unaddressed | elastic@FreeBSD.org |
| textproc/kibana93 | kibana93 | 9.3.8 | possibly backported | elastic@FreeBSD.org |
| textproc/kibana94 | kibana94 | 9.4.7 | fixed by update | elastic@FreeBSD.org |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>kibana91</name>
<range><lt>9.4.6</lt></range>
</package>
<package>
<name>kibana92</name>
<range><lt>9.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Missing Authorization (CWE-862) in Kibana can lead to information
disclosure via Exploiting Incorrectly Configured Access Control
Security Levels (CAPEC-180). An authenticated user holding minimal
Elasticsearch privileges could bypass Kibana feature authorization and
space access controls, resulting in the unauthorized disclosure of
Fleet deployment metadata from the default Kibana space.</p>
</body>
</description>
<references>
<cvename>CVE-2026-78603</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-78603</url>
</references>
<dates>
<discovery>2026-09-01</discovery>
<entry>2026-10-26</entry>
</dates>
</vuln>